> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/control/members/directory-access.md).

# Directory access

Directory access lets Project and organisation access follow the groups in your identity provider. Connect Microsoft Entra ID or a SCIM directory once, map a directory group to a role, and Lleverage keeps the members of that group in step: people who join the group gain the role, people who leave it lose the role, and disabled accounts lose directory-sourced access.

{% hint style="info" %}
**Availability:** Directory access is available for Enterprise customers and must currently be enabled by Lleverage for your organisation. Contact your Lleverage representative to enable it.
{% endhint %}

## Two ways to connect

**Microsoft Entra ID.** A Global Administrator of your tenant grants Lleverage two read-only application permissions. Lleverage then reads groups and their members from Microsoft Graph. Nothing is written to your directory, and Lleverage reads only the groups you map.

See [Connect Microsoft Entra ID](/administer-and-govern/control/members/directory-access/connect-microsoft-entra-id.md).

**SCIM directory (through WorkOS).** Your IT team assigns users and groups to the Lleverage application in Okta, Entra ID, Google Workspace, OneLogin or another SCIM 2.0 provider, and the directory pushes those people to Lleverage over SCIM. Lleverage sees only what is assigned and asks for no Microsoft Graph permissions.

See [Connect a SCIM directory](/administer-and-govern/control/members/directory-access/connect-a-scim-directory.md).

Choose Entra ID when your team is on Microsoft 365 and you want to map existing groups without additional provisioning configuration in the identity provider. Choose SCIM when your IT team prefers to control the people and groups assigned from their side, or when your directory is not Entra.

## How access flows

1. You map a directory group to a Project role (Owner, Builder or Operator) or an organisation role (Owner or Member).
2. Lleverage keeps a mirror of that group in the organisation. Members of the directory group become members of the mirror group, and the mirror group holds the role.
3. The sync runs on the schedule you configure and applies what changed. A SCIM directory also pushes changes as they happen.
4. When someone signs in, Lleverage refreshes them from the directory before showing the organisation, so recent access changes do not have to wait for the next scheduled sync.

Access that someone holds directly, by invitation or through an Everyone grant sits alongside group access. The highest role wins, and removing a group never removes a direct grant.

See [Grant access with directory groups](/administer-and-govern/control/members/directory-access/grant-access-with-directory-groups.md) for mappings, Everyone grants, unmatched members, leavers and sync monitoring.

## Security and troubleshooting

See [Security notes](/administer-and-govern/control/members/directory-access/security-notes.md) for permissions, stored data, audit retention and disconnect behaviour, and the [Directory access FAQ](/administer-and-govern/control/members/directory-access/faq.md) for common access and sync questions.

## Directory access and SSO

Directory access and Enterprise SSO are separate. SSO decides how people sign in; directory access decides what they can reach once they have. You can use Entra directory access without configuring SCIM, while the SCIM directory path uses the same WorkOS organisation as Enterprise SSO.

See [Enterprise SSO Setup](/administer-and-govern/control/members/sso-setup.md) for authentication setup.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.lleverage.ai/administer-and-govern/control/members/directory-access.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.