> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/connect-a-scim-directory.md). # Connect a SCIM directory A SCIM directory works the other way round from Entra ID: instead of Lleverage reading your directory, your identity provider pushes the users and groups your IT team assigns to Lleverage. Lleverage sees only what is assigned and asks for no permissions in your tenant. Lleverage receives SCIM through WorkOS, which supports Okta, Microsoft Entra ID, Google Workspace, OneLogin and other providers that speak SCIM 2.0. {% hint style="info" %} Directory access must currently be enabled by Lleverage for your organisation before you can configure it. {% endhint %} ## Before you start * Your organisation is on the Enterprise plan and directory access has been enabled by Lleverage. * Enterprise SSO is already set up for the organisation. The SCIM directory attaches to the same WorkOS organisation as your SSO connection, and Lleverage will not create a second one. See [Enterprise SSO Setup](/administer-and-govern/control/members/sso-setup.md). * You are an Organisation Owner in Lleverage. * Someone who administers your identity provider is available to complete the setup. ## 1. Generate the setup link 1. Go to **Organisation Settings → Directory**. 2. Under **SCIM directory (WorkOS)**, select **Set up SCIM directory**. 3. Copy the admin portal link. The link opens the WorkOS setup portal for your organisation. It is short-lived and works for whoever opens it, so send it only to the person doing the setup. Generate a new one whenever you need it; the Directory page shows **Generate a new setup link** while setup is pending. ## 2. Complete the setup in the portal In the portal your administrator picks the identity provider and follows its steps: creating a SCIM application, pasting the endpoint and bearer token WorkOS shows, and turning on provisioning. The portal has the exact steps for each provider. Then, in the identity provider, they assign the users and groups that Lleverage should know about. Only assigned people and groups reach Lleverage. A group you expect to map will not appear until IT assigns it. While this is happening the Directory page shows the connection as waiting for the directory. It turns active on its own once WorkOS reports the directory linked; there is nothing to confirm in Lleverage. If you change your mind, **Cancel** removes the pending connection. ## 3. Choose how the sync behaves The settings under **Sync behaviour** are the same as for Entra ID, with one difference in how they are used: a SCIM directory pushes each change as it happens, so a person assigned in the identity provider arrives within moments rather than at the next interval. The interval still governs the periodic reconcile that checks nothing was missed, and **Reconcile now** runs it on demand. | Setting | Default | What it does | | -------------------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | Sync every | 15 minutes | How often Lleverage reconciles what it holds against the directory. 5 to 60 minutes. | | Create accounts before first sign-in | On | A mapped member without a Lleverage account gets one straight away | | Create accounts for unverified email domains | Off | Also create accounts for members whose email domain your organisation has not verified | | Remove access when someone leaves a group | On | Leaving a mapped group, or being unassigned from the application, removes the role it gave. Off keeps the role and lists the person for review. | | Sign out disabled accounts | On | When the directory reports an account deactivated, end their Lleverage sessions in this organisation as well as removing access | | Sign out suspended members | Off | Also end sessions when an owner suspends a directory member in a group | | Everyone includes guests | Off | Whether an Everyone grant covers guests | | Sync digests | On | Owners get one email per 15 minutes summarising access changes. Failure alerts are always sent. | | Welcome new accounts by email | Off | Email people the sync created an account for, once they hold Project access | | Alias domains | none | Pairs of directory domain and Lleverage domain for matching | ## What arrives over SCIM Your identity provider sends Lleverage, for each assigned user, their name, email address, whether the account is active, and the assigned groups they belong to. It sends group names and membership for assigned groups. Nothing else in the directory is visible to Lleverage. Nested groups behave as your identity provider presents them over SCIM. Lleverage maps whatever membership arrives; whether a member of a nested group counts as a member of the parent depends on the provider's SCIM implementation, so check with a test group before relying on it. ## Membership changes | Change in the identity provider | What happens in Lleverage | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | User assigned to the application | Account created (if the setting is on) and any mapped group roles applied | | User added to a mapped group | Role applied within moments | | User removed from a mapped group | Role removed, or listed for review if "Remove access when someone leaves a group" is off | | User unassigned from the application, or deactivated | Every directory-sourced role removed; sessions ended if "Sign out disabled accounts" is on; listed under Needs review | | Group unassigned or deleted | Its mapping stops applying; members lose the role unless something else grants it | | Directory deactivated in WorkOS, or WorkOS can no longer sign in to the identity provider | The connection shows an error and owners are emailed. Access stays as it was until the directory is repaired from the portal or you disconnect. Lleverage checks every 30 minutes and clears the error once the directory is usable again. | | Directory deleted in WorkOS | Treated as a disconnect: every directory-sourced role is removed and mirror groups are archived | ## Next step See [Grant access with directory groups](/administer-and-govern/control/members/directory-access/grant-access-with-directory-groups.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/connect-a-scim-directory.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.