Tenancy and identity
Directory Sync
How people get into this tenant and what they may do once inside. more
Enterprise sign-in
A provider appears on the sign-in page only when all its settings are present
Microsoft Entra ID
AUTH_MICROSOFT_ENTRA_ID_ID · AUTH_MICROSOFT_ENTRA_ID_SECRET · AUTH_MICROSOFT_ENTRA_ID_TENANT_ID
callback /api/auth/callback/azure-ad
Okta
AUTH_OKTA_ID · AUTH_OKTA_SECRET · AUTH_OKTA_ISSUER
callback /api/auth/callback/okta
Auth0
AUTH_AUTH0_ID · AUTH_AUTH0_SECRET · AUTH_AUTH0_ISSUER
callback /api/auth/callback/auth0
Directory provisioning (SCIM 2.0)
Users only. Delete switches an account off, it never removes the row.
Base URL /api/scim/v2, bearer token from SCIM_TOKEN, tenant from SCIM_TENANT. Supported: list with userName eq, get, create, replace, patch on active, userName, displayName and externalId, and delete. New accounts start as Requester.
A switched-off account is refused at its next account check, at most 60 seconds later, even with a live session.
accounts by origin: unrecorded 186
Directory group to role
Applied at each SSO sign-in. more
No group is mapped yet, so SSO accounts keep the role they have.
Mapping a group needs the Enterprise Chief of Staff role.
Session policy
Read from the environment, the same values sign-in enforces
Idle limit
8 hrs
SESSION_MAX_AGE_SECONDS
Absolute limit from sign-in
12 hrs
SESSION_ABSOLUTE_MAX_SECONDS
Account recheck
60 s
role and active flag re-read
Actions
What is waiting on a person
Sign-on and provisioning belong to the client directory. more
Operations
What this desk is allowed to start
A surface that only reports is not operable. more
Trigger and bound
Across tenants, 187 people hold accounts and 0 group-to-role rules are defined. 0 accounts came from directory provisioning.
Live observability
What the record shows right now
Every account by state. Each account is active or not.
Current distribution
187 people
Is policy and strategy coming to fruition
Whether the written intent is holding here
Not yet. The plumbing exists and no client directory is connected.
Not holding on the record
The intent is that access follows the client directory, joiners and leavers included, with no local passwords. more