Directory Provisioning
Directory provisioning lets your identity provider manage who belongs to your organization over SCIM 2.0. While it is on, only people the provider lists can join, and deactivating someone there removes them here. It is an Enterprise feature, and it is set up alongside single sign-on.
Okta and Microsoft Entra ID both provision this way, and each has a walkthrough: Okta, Microsoft Entra ID. Google Workspace provisions only the applications in its own catalog, so it cannot be used for this; single sign-on from Google works without it.
Turn it on
Section titled “Turn it on”Open Organization settings → Single sign-on, scroll to Directory
provisioning, and choose Turn on directory provisioning. Then name a
token after the system that will use it and choose Create token. The
token starts with wpscim_ and is shown once.
Give your provider two values:
| Workprentice shows | Also called |
|---|---|
| SCIM endpoint | Base URL, tenant URL, SCIM connector base URL |
| New token | Secret token, bearer token, API token |
The provider authenticates with the token as an HTTP bearer header. A token works only on the SCIM endpoint and only for your organization. Revoke one from the list at any time, and issue a second before revoking the first when you need to rotate without an interruption.
What the directory changes
Section titled “What the directory changes”Provisioning a person does not create an account or take a seat. It records that the provider vouches for them. The account, and the seat, arrive when they first sign in, so provisioning a large group costs nothing until its people use Workprentice. If the organization has reached its seat limit by then, they wait for a seat.
| At the provider | In Workprentice |
|---|---|
| A person is assigned to the application | They may join. Nothing else happens until they sign in. |
| A person is deactivated or unassigned | They can no longer sign in through the provider, at once. They are then removed from the organization the way an admin’s removal does it: their sessions end, their credentials are revoked, and their private work moves into custody. The removal is queued, so it follows shortly after and is not instant. |
| A person is reactivated | They may join again, and rejoin at their next sign-in, unless an admin also removed them by hand. |
| A person is deleted, then added again later | They are a new record. If the deletion removed them, invite them back. |
| A person’s email changes | The directory record changes. An existing account keeps the address it has. |
While provisioning is on, joining by email domain, a join suggestion, and a first single sign-on all need an active directory record. Invitations still work for people outside the directory, such as contractors.
Turning provisioning on removes nobody. A member the provider has never listed stays until the provider lists and then deactivates them, or an admin removes them.
An organization owner cannot be removed this way. The provider’s request is refused, so a mistake in the directory cannot leave the organization without an owner. Transfer ownership first.
There is no limit on how many people one sync can remove. If your provider has a safeguard against accidental mass deactivation, such as Entra’s accidental deletion threshold, turn it on there.
Give groups access to workspaces
Section titled “Give groups access to workspaces”Groups pushed from the provider appear under Group access. Map a group to a workspace and a role, and its members get that role there.
- Roles are viewer, member, or admin. A group cannot make someone a workspace owner.
- A person in several mapped groups gets the highest role any of them gives.
- Access a group gave ends when the person leaves the group, or when the mapping or the group is removed.
- Access someone was given by hand is never changed or removed by a group.
- Access a group gave cannot be edited by hand. The edit is refused, since the next sync would undo it. Change the group or the mapping instead.
- Organization owners and admins are left alone, because their role already decides their access to every workspace.
Group access is applied when a group or a mapping changes and when a person signs in through the provider, so someone who has not signed in yet gets it the first time they do. Someone who joins another way, by invitation for example, gets it at whichever of those comes next.
Turn it off
Section titled “Turn it off”Turn off forgets the directory and stops its tokens working. Current members stay members and people can join again by your other rules. Your provider can no longer remove anyone, so remove leavers by hand from then on.
What is supported
Section titled “What is supported”The endpoint implements SCIM 2.0 users and groups with create, read,
replace, patch, and delete. Filters are equality only: userName or
externalId for users, displayName or externalId for groups. Bulk
operations, sorting, and ETags are not supported.
For the complete site index, see llms.txt.