Skip to main content

​
SSO user provisioning

When users authenticate via SSO for the first time, their user account is automatically created based on the information provided by your identity provider.
Automatic account creation: New users are automatically added to your organization when they successfully authenticate via SSO, provided their email domain is configured for SSO.

​
Does Ravenna support SCIM?

Ravenna does not offer a SCIM endpoint for provisioning users and groups into Ravenna. User accounts in Ravenna are created just-in-time on first SSO sign-in, and deactivation happens automatically when the user can no longer authenticate through the identity provider. For syncing users and groups from an identity provider, use one of the Okta, Google Workspace, Microsoft Entra ID, or JumpCloud integrations. These keep group membership in sync so access policies and group provisioning work against the same directory you already manage. For provisioning access to downstream applications, Ravenna does not act as a SCIM client either. Access requests provision through the connected identity provider using group or direct application assignment, or through a workflow. See provisioning methods for the options that are available, including manual provisioning for tools that are not connected to an identity provider.

​
User roles and permissions

SSO users are automatically added to your organization with default member permissions. However, there are important considerations for workspace access:
Important: New SSO users are added to the organization but are not automatically assigned to any workspaces. They will need to be manually added to workspaces through the Ravenna app.

​
Organization-level permissions

New SSO users default to Member role at the organization level. To modify their organization role:
  1. Navigate to Organization Settings → Members
  2. Find the SSO user in the organization member list
  3. Update their organization role (Member, Admin, etc.) as needed

​
Workspace access

After SSO authentication, users need workspace access:
  1. Navigate to the specific workspace
  2. Go to Members within that workspace
  3. Add the SSO user to the workspace
  4. Set their workspace role and permissions as needed

​
Deactivating SSO users

When employees leave your organization:
  1. Remove from IdP: Deactivate or remove the user from your identity provider
  2. Automatic deactivation: The user will no longer be able to authenticate via SSO
  3. Manual cleanup: Optionally remove the user from organization settings

​
Custom attribute mapping

For complex organizational structures, you may need custom attribute mapping:

​
Configuring attribute mapping

Work with your identity provider administrator to ensure these attributes are included in the authentication response and properly mapped to your organizational structure.

​
Best practices

​
User access reviews

  • Regular audits: Periodically review SSO user access and remove inactive accounts
  • Role validation: Ensure users have appropriate permissions for their current role
  • Workspace membership: Verify users are in the correct workspaces

​
Emergency access

Always maintain emergency access to your organization:
Important: Ensure at least one organization admin account uses password authentication as a backup method in case SSO becomes unavailable. This account must not have the same email domain as your SSO-managed domains.
Last modified on August 26, 2026