Identity · SSO and SCIM. Keep team access in sync with your directory.

StackOne supports SAML single sign-on with guided setup for Okta, Microsoft Entra and Google Workspace. You can also use just-in-time provisioning to create members on their first sign-in. The SSO documentation covers the configuration requirements for each provider.

Yes. StackOne supports SCIM provisioning from Okta and Microsoft Entra. SCIM creates members and groups, applies membership changes from your directory, and suspends a StackOne membership when it processes a deactivation.

In StackOne, just-in-time provisioning creates a member the first time they sign in, with the default role and project you configure. SCIM keeps membership in sync with your directory over time, including updates and deactivations.

Yes, from Okta and Microsoft Entra. StackOne syncs groups through SCIM, and synced membership stays managed in your directory. Groups created manually are managed in StackOne, and both kinds can receive access grants. Google Workspace supports SAML sign-in and just-in-time provisioning, but not SCIM group sync.

Yes. You can set which sign-in methods your StackOne organization permits, for example SAML SSO only. Enforcing sign-in methods is an Enterprise control. If someone belongs to several organizations, their permitted methods also depend on those organizations' rules, so ask us to review your setup.

When StackOne processes a SCIM deactivation, it suspends the membership in that organization and deletes its sessions, so the membership no longer authorizes member-based access. Project assignments and group grants are kept for reactivation, which needs a fresh sign-in. Unrelated API keys and memberships in other organizations aren't affected.