> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/faq.md). # Directory access FAQ ## We already use SSO Enterprise SSO and directory access work together, and connecting a directory changes one thing about SSO. Without a directory, SSO auto-join adds everyone who signs in through your identity provider to the organisation as a Member with Operator access to the organisation's oldest unarchived Project. Anyone your identity provider lets into the Lleverage application on a configured domain gets that baseline access. Once a directory is connected, auto-join stops. Signing in through SSO still authenticates the person, but what they can reach comes from group mappings and Everyone grants. Someone who signs in and is in no mapped group sees that nothing is shared with them yet and can check the directory again. People who joined through auto-join before you connected the directory keep what they had. The Directory page shows a one-time prompt under **Single sign-on users** so you can decide whether to represent that baseline as an explicit Everyone grant or leave existing members as they are and let new sign-ins get access from mappings only. ## Someone was added to a group but still has no access In order of likelihood: 1. **The sync has not run yet.** Changes arrive at the interval you set, 15 minutes by default. Select **Sync now** on the Directory page, or ask the person to sign in again; sign-in refreshes them from the directory. 2. **They are listed under Members without access.** The reason is next to their name. Common causes are an unverified email domain and an address that does not match. 3. **They are a guest.** Group mappings never provision guests. Invite them by hand. 4. **They are suspended in the group.** An owner suspended them from the Project's Members page. Unsuspend them there. 5. **For SCIM, the group is not assigned to Lleverage.** Membership only reaches Lleverage for assigned groups. Ask IT to assign it. 6. **Cached permissions.** After a change, a person who is already signed in may keep old permissions for up to five minutes. ## Someone was removed from a group but still has access * **They hold the role another way.** Check their entry on the Project's Members page: a direct grant, another group, or an Everyone grant. The directory never removes access it did not give. * **Remove access when someone leaves a group is off.** They are listed under Needs review for you to decide. * **The sync has not run yet**, or the change is within the five-minute cache window. ## Our users have `@company.onmicrosoft.com` addresses Some tenants give users a user principal name on the `onmicrosoft.com` domain while their real email address is on the company domain, or the other way round. Lleverage matches on the mail address first and the user principal name second, so most people match. For those who do not, add an alias domain under **Sync behaviour**, for example from `company.onmicrosoft.com` to `company.com`. ## Can one Entra tenant serve several Lleverage organisations? Yes. Each organisation completes its own consent and keeps its own mappings and settings. Groups can be mapped in more than one organisation. ## Can one organisation use both Entra ID and SCIM? No. An organisation has one directory connection at a time. You can switch by disconnecting the current one and then connecting the other. Switching removes every directory-sourced role and the catalogue, and the first sync of the new provider starts from nothing, so plan a short window while access is rebuilt. ## How quickly does a disabled account lose access? Within one sync interval, so up to 15 minutes at the default, and immediately if you select **Sync now**. Over SCIM the change is pushed and usually lands within a minute. With **Sign out disabled accounts** on, SSO sessions for the organisation are ended in the same pass. Cached permissions can take up to five minutes to expire. ## Does Lleverage change anything in our directory? No. Entra ID access is read-only, and a SCIM directory is pushed to Lleverage by your identity provider. Lleverage never creates, edits or deletes anything in your directory. ## What happens if we remove the enterprise application in Entra? The next sync fails, the Directory page shows the error and Organisation Owners are emailed. Access stays as it was at the last successful sync. Generate a new consent link to reconnect, or **Disconnect** in Lleverage to remove directory-sourced access. ## Can we map a group to the Owner role? Yes, for the organisation and for Projects. Mapping a group to organisation Owner asks you to type the group's name to confirm because every member of that group then has full control of the organisation, including directory settings. ## Why does the mapping preview say someone is unchanged? They already hold that role or a higher one from another source. The highest role wins, and the preview only lists people whose effective access will change. ## What does a partial sync mean? The run hit its time budget before finishing and will continue on the next tick. Each group is applied in one step, so a group is either applied or not yet touched. Large tenants with many mapped groups may show partial runs after a full read; delta runs are much smaller. ## Who gets the sync emails? Every Organisation Owner. Failures always; access-change digests unless **Sync digests** is off. Provisioned members can also receive welcome messages when **Welcome new accounts by email** is on. ## Where do I see what the directory did? **Sync activity** on the Directory page shows recent runs. **Organisation Settings → Activity → Access activity** shows grants, removals and role changes with the group and run that caused them. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/faq.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.