SSO / Identity

Enable enterprise SSO

Default role (no group match)

Auto-provision on first login

Enable OIDC

Issuer URL

Client ID

Client Secret

Scopes

Groups claim

Redirect URI (register this in the IdP)

Enable SAML

IdP Entity ID IdP SSO URL IdP signing certificate (PEM or base64)

Groups attribute

SP metadata / ACS (give these to the IdP)

First/highest match wins. A user in no listed group gets the default role.

Point your IdP's SCIM connector at the Base URL with the bearer token below. Deprovisioning a user here immediately revokes their sessions.

SCIM Base URL

…

OIDC — Okta, Entra ID, Auth0, PingOne, Keycloak, ADFS