Directory access

Directory access lets Project and organisation access follow the groups in your identity provider. Connect Microsoft Entra ID or a SCIM directory once, map a directory group to a role, and Lleverage keeps the members of that group in step: people who join the group gain the role, people who leave it lose the role, and disabled accounts lose directory-sourced access.

Availability: Directory access is available for Enterprise customers and must currently be enabled by Lleverage for your organisation. Contact your Lleverage representative to enable it.

Two ways to connect

Microsoft Entra ID. A Global Administrator of your tenant grants Lleverage two read-only application permissions. Lleverage then reads groups and their members from Microsoft Graph. Nothing is written to your directory, and Lleverage reads only the groups you map.

See Connect Microsoft Entra ID.

SCIM directory (through WorkOS). Your IT team assigns users and groups to the Lleverage application in Okta, Entra ID, Google Workspace, OneLogin or another SCIM 2.0 provider, and the directory pushes those people to Lleverage over SCIM. Lleverage sees only what is assigned and asks for no Microsoft Graph permissions.

See Connect a SCIM directory.

Choose Entra ID when your team is on Microsoft 365 and you want to map existing groups without additional provisioning configuration in the identity provider. Choose SCIM when your IT team prefers to control the people and groups assigned from their side, or when your directory is not Entra.

How access flows

1. You map a directory group to a Project role (Owner, Builder or Operator) or an organisation role (Owner or Member).

2. Lleverage keeps a mirror of that group in the organisation. Members of the directory group become members of the mirror group, and the mirror group holds the role.

3. The sync runs on the schedule you configure and applies what changed. A SCIM directory also pushes changes as they happen.

4. When someone signs in, Lleverage refreshes them from the directory before showing the organisation, so recent access changes do not have to wait for the next scheduled sync.

Access that someone holds directly, by invitation or through an Everyone grant sits alongside group access. The highest role wins, and removing a group never removes a direct grant.

See Grant access with directory groups for mappings, Everyone grants, unmatched members, leavers and sync monitoring.

Security and troubleshooting

See Security notes for permissions, stored data, audit retention and disconnect behaviour, and the Directory access FAQ for common access and sync questions.

Directory access and SSO

Directory access and Enterprise SSO are separate. SSO decides how people sign in; directory access decides what they can reach once they have. You can use Entra directory access without configuring SCIM, while the SCIM directory path uses the same WorkOS organisation as Enterprise SSO.

See Enterprise SSO Setup for authentication setup.