🔑 Onboard your workforce with SSO and SCIM
Stack: Auth: SAML / OIDC single sign-on · Provisioning: SCIM · Mapping: directory groups → roles · Output: managed identity, automatic deprovisioning
Who it’s for: IT admins who want almyty behind the same identity provider as everything else, and users off it the day they leave. What it does: connects almyty to your IdP so people sign in with your directory (Okta, Entra ID, Google Workspace), and SCIM provisions and deprovisions accounts automatically, no manual invites, no orphaned access.
Note: SSO/SCIM is code-complete and covered by tests, but end-to-end verification needs a live IdP. Treat the steps below as the configuration path; confirm against your own IdP before relying on it in production.
Build it
- Connect your IdP: configure SAML or OIDC with your provider’s metadata; users then sign in through your directory.
- Enable SCIM provisioning: point your IdP’s SCIM connector at almyty so new hires get accounts and departures are removed automatically.
- Map groups to roles: a directory group becomes a team role, so access follows the org chart instead of manual assignment.
- Enforce it: require SSO for the org so shared logins and local passwords aren’t an option.
- Verify the trail: sign-ins and provisioning events land in the audit trail, tied to real directory identities.
Make it yours
- Scope contractors to a group that maps to a time-boxed role.
- Combine with approval policies so the approver is a real, current employee.
- Deprovision instantly on offboarding, SCIM removes access without a ticket.
Uses: Enterprise · SSO · SCIM · Identity