Connect a SCIM directory
A SCIM directory works the other way round from Entra ID: instead of Lleverage reading your directory, your identity provider pushes the users and groups your IT team assigns to Lleverage. Lleverage sees only what is assigned and asks for no permissions in your tenant.
Lleverage receives SCIM through WorkOS, which supports Okta, Microsoft Entra ID, Google Workspace, OneLogin and other providers that speak SCIM 2.0.
Before you start
Your organisation is on the Enterprise plan and directory access has been enabled by Lleverage.
Enterprise SSO is already set up for the organisation. The SCIM directory attaches to the same WorkOS organisation as your SSO connection, and Lleverage will not create a second one. See Enterprise SSO Setup.
You are an Organisation Owner in Lleverage.
Someone who administers your identity provider is available to complete the setup.
1. Generate the setup link
Go to Organisation Settings → Directory.
Under SCIM directory (WorkOS), select Set up SCIM directory.
Copy the admin portal link.
The link opens the WorkOS setup portal for your organisation. It is short-lived and works for whoever opens it, so send it only to the person doing the setup. Generate a new one whenever you need it; the Directory page shows Generate a new setup link while setup is pending.
2. Complete the setup in the portal
In the portal your administrator picks the identity provider and follows its steps: creating a SCIM application, pasting the endpoint and bearer token WorkOS shows, and turning on provisioning. The portal has the exact steps for each provider.
Then, in the identity provider, they assign the users and groups that Lleverage should know about. Only assigned people and groups reach Lleverage. A group you expect to map will not appear until IT assigns it.
While this is happening the Directory page shows the connection as waiting for the directory. It turns active on its own once WorkOS reports the directory linked; there is nothing to confirm in Lleverage. If you change your mind, Cancel removes the pending connection.
3. Choose how the sync behaves
The settings under Sync behaviour are the same as for Entra ID, with one difference in how they are used: a SCIM directory pushes each change as it happens, so a person assigned in the identity provider arrives within moments rather than at the next interval. The interval still governs the periodic reconcile that checks nothing was missed, and Reconcile now runs it on demand.
Sync every
15 minutes
How often Lleverage reconciles what it holds against the directory. 5 to 60 minutes.
Create accounts before first sign-in
On
A mapped member without a Lleverage account gets one straight away
Create accounts for unverified email domains
Off
Also create accounts for members whose email domain your organisation has not verified
Remove access when someone leaves a group
On
Leaving a mapped group, or being unassigned from the application, removes the role it gave. Off keeps the role and lists the person for review.
Sign out disabled accounts
On
When the directory reports an account deactivated, end their Lleverage sessions in this organisation as well as removing access
Sign out suspended members
Off
Also end sessions when an owner suspends a directory member in a group
Everyone includes guests
Off
Whether an Everyone grant covers guests
Sync digests
On
Owners get one email per 15 minutes summarising access changes. Failure alerts are always sent.
Welcome new accounts by email
Off
Email people the sync created an account for, once they hold Project access
Alias domains
none
Pairs of directory domain and Lleverage domain for matching
What arrives over SCIM
Your identity provider sends Lleverage, for each assigned user, their name, email address, whether the account is active, and the assigned groups they belong to. It sends group names and membership for assigned groups. Nothing else in the directory is visible to Lleverage.
Nested groups behave as your identity provider presents them over SCIM. Lleverage maps whatever membership arrives; whether a member of a nested group counts as a member of the parent depends on the provider's SCIM implementation, so check with a test group before relying on it.
Membership changes
User assigned to the application
Account created (if the setting is on) and any mapped group roles applied
User added to a mapped group
Role applied within moments
User removed from a mapped group
Role removed, or listed for review if "Remove access when someone leaves a group" is off
User unassigned from the application, or deactivated
Every directory-sourced role removed; sessions ended if "Sign out disabled accounts" is on; listed under Needs review
Group unassigned or deleted
Its mapping stops applying; members lose the role unless something else grants it
Directory deactivated in WorkOS, or WorkOS can no longer sign in to the identity provider
The connection shows an error and owners are emailed. Access stays as it was until the directory is repaired from the portal or you disconnect. Lleverage checks every 30 minutes and clears the error once the directory is usable again.
Directory deleted in WorkOS
Treated as a disconnect: every directory-sourced role is removed and mirror groups are archived
Next step
Was this helpful?