How users get accounts
At first SSO sign-in
Anyone assigned to the Ravenna application in your IdP gets an account the first time they sign in. They join your organization as a Member. Existing users keep their current role.
From a directory sync
Some directory integrations create accounts before users sign in. For example, the Okta integration adds synced users to your organization as Members.
Access comes from the application assignment in your IdP, not from the email domain. The domain only decides whether Ravenna sends users to your IdP automatically when they enter their email. See Configure your identity provider.
Does Ravenna support SCIM?
Does Ravenna support SCIM?
No. Ravenna doesn’t offer a SCIM endpoint for provisioning users and groups into Ravenna. Accounts are created at first SSO sign-in. Removing a user from your IdP stops them from signing in, but doesn’t deactivate or remove their Ravenna account. See Deactivate SSO users.To sync users and groups from your IdP, connect the Okta, Google Workspace, Microsoft Entra ID, or JumpCloud integration. These keep group membership in sync, so access policies and group provisioning use the same directory you already manage.Ravenna isn’t a SCIM client for downstream applications either. Access requests provision through the connected IdP with group or direct application assignment, or through a workflow. See provisioning methods, including manual provisioning for tools that aren’t connected to an IdP.
Roles and workspace access
Change a user’s organization role
Organization roles are Admin and Member. You need organization admin access to change them.1
Open the member
Go to Settings > Organization > Members and click the user.
2
Change the role
On the Details tab, click Edit, choose an Organization Role, and save.
Add a user to a workspace
Workspace roles are Admin and Member. Add users from the workspace or from your organization’s member list.- From the workspace
- From organization settings
- Automatically with groups
1
Open workspace members
In the workspace sidebar, click Members, then click New.
2
Add the user
In Member, search for the user. Choose a Role, then save.
Learn more about roles and access
Deactivate SSO users
When someone leaves, remove their access in your IdP and in Ravenna. Unassigning or deactivating them in your IdP stops new SSO sign-ins, but doesn’t end a session they already have, and their Ravenna account stays active.Deactivate User
RecommendedEnds their sessions right away, blocks new sign-ins, and stops every API key they created. Their account stays in your member list with a Deactivated badge, so their tickets and history stay intact.
Remove
Takes them out of your organization and every workspace. If they can still sign in through your IdP, Ravenna adds them back as a Member the next time they sign in.
1
Unassign the user in your IdP
Deactivate the user, or remove them from the Ravenna application, in your IdP.
2
Deactivate the user in Ravenna
Go to Settings > Organization > Members. Open the user’s row actions, select Deactivate User, then click Deactivate user to confirm.
Learn more about deactivating and reactivating users
User profile attributes
Ravenna reads these attributes from your IdP only when it creates a user’s account at their first sign-in. Later sign-ins don’t update them.
Ravenna doesn’t read groups, manager, or department from SSO sign-ins. To get them and keep names up to date, connect a directory or HRIS integration, such as Okta, Google Workspace, Microsoft Entra ID, JumpCloud, or BambooHR.