Directory Sync: User and Group Provisioning over SCIM

Directory Sync connects Okta or Microsoft Entra to StackOne over SCIM 2.0. Assign someone to the StackOne app in your identity provider and they get a StackOne account with the project access you chose. Deactivate them in the directory and their access is suspended and their sessions end. Groups you push from the directory arrive as Groups in StackOne, so the access you grant a group follows its membership in the directory.

What’s new

• User provisioning - Select Link SCIM on the SSO connection’s Provisioning tab, then paste the SCIM base URL and token into your identity provider. Assigned users join with the projects and roles set in Provisioned access.
• Deprovisioning - Deactivating or unassigning a user suspends their access to the organization, removes them from synced groups and signs them out. Reactivating them in the directory lifts the suspension.
• Group sync - Groups pushed from Okta or Entra appear on the Groups tab of Manage Team with a Synced tag. The identity provider owns their names and members, and you assign them to projects and accounts with a role, like any other group.
• Access ready before the first push - An empty StackOne group with the same name as a directory group is taken over by the push and keeps its assignments, so members get the right access the moment they arrive.

Directory Sync runs on your SSO connection, so set that up first. Then follow the SCIM Provisioning guide and SCIM Groups.

Availability

• Available on Enterprise plans only. See pricing.