> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# User management

> Manage SSO users in Ravenna, including just-in-time provisioning, organization and workspace roles, profile attributes, and blocking or removing users who leave.

export const Checkbox = ({items = []}) => {
  const [checked, setChecked] = useState(Array(items.length).fill(false));
  const toggle = index => {
    setChecked(prev => {
      const copy = [...prev];
      copy[index] = !copy[index];
      return copy;
    });
  };
  return <div className="custom-checkbox-list">
      {items.map((text, index) => <div key={index} className="custom-checkbox-item flex items-center mb-2">
          <input type="checkbox" checked={checked[index]} onChange={() => toggle(index)} className="mr-2" />
          <span>{text}</span>
        </div>)}
    </div>;
};

Your identity provider (IdP) decides who can sign in to Ravenna. Ravenna decides what they can do once they're in: their organization role, which workspaces they belong to, and whether their account is blocked. Use this page to manage SSO users from their first sign-in to the day they leave.

## How users get accounts

<CardGroup cols={2}>
  <Card title="At first SSO sign-in" icon="user-plus">
    Anyone assigned to the Ravenna application in your IdP gets an account the first time they sign in. They join your organization as a **Member**. Existing users keep their current role.
  </Card>

  <Card title="From a directory sync" icon="refresh-cw" href="/integrations/okta/overview#auto-provisioning-during-sync">
    Some directory integrations create accounts before users sign in. For example, the Okta integration adds synced users to your organization as Members.
  </Card>
</CardGroup>

<Info>
  Access comes from the application assignment in your IdP, not from the email domain. The domain only decides whether Ravenna sends users to your IdP automatically when they enter their email. See [Configure your identity provider](/integrations/sso/setup#configure-your-identity-provider).
</Info>

<AccordionGroup>
  <Accordion title="Does Ravenna support SCIM?" icon="circle-question-mark">
    No. Ravenna doesn't offer a SCIM endpoint for provisioning users and groups into Ravenna. Accounts are created at first SSO sign-in. Removing a user from your IdP stops them from signing in, but doesn't block or remove their Ravenna account. See [Deactivate SSO users](#deactivate-sso-users).

    To sync users and groups from your IdP, connect the [Okta](/integrations/okta/overview), [Google Workspace](/integrations/google-workspace/overview), [Microsoft Entra ID](/integrations/microsoft-entra/overview), or [JumpCloud](/integrations/jumpcloud/overview) integration. These keep group membership in sync, so [access policies](/documentation/automate/access-provisioning/policies) and [group provisioning](/documentation/automate/access-provisioning/applications#provisioning-methods) use the same directory you already manage.

    Ravenna isn't a SCIM client for downstream applications either. Access requests provision through the connected IdP with group or direct application assignment, or through a workflow. See [provisioning methods](/documentation/automate/access-provisioning/applications#provisioning-methods), including manual provisioning for tools that aren't connected to an IdP.
  </Accordion>
</AccordionGroup>

## Roles and workspace access

<Warning>
  SSO sign-in adds new users to your organization, but not to any workspace. Add them to the workspaces they need, or grant access through [user groups](/documentation/platform/workspaces/settings#user-group-membership).
</Warning>

### Change a user's organization role

Organization roles are **Admin** and **Member**. You need organization admin access to change them.

<Steps>
  <Step title="Open the member">
    Go to **Settings > Organization > Members** and click the user.
  </Step>

  <Step title="Change the role">
    On the **Details** tab, click **Edit**, choose an **Organization Role**, and save.
  </Step>
</Steps>

### Add a user to a workspace

Workspace roles are **Admin** and **Member**. Add users from the workspace or from your organization's member list.

<Tabs>
  <Tab title="From the workspace" icon="layout-grid">
    <Steps>
      <Step title="Open workspace members">
        In the workspace sidebar, click **Members**, then click **New**.
      </Step>

      <Step title="Add the user">
        In **Member**, search for the user. Choose a **Role**, then save.
      </Step>
    </Steps>
  </Tab>

  <Tab title="From organization settings" icon="building-2">
    <Steps>
      <Step title="Open organization members">
        Go to **Settings > Organization > Members** and click **New**.
      </Step>

      <Step title="Add the user to workspaces">
        Enter the user's email in **Email Addresses**, choose one or more **Workspaces**, choose a **Workspace Role**, then save. You can only add users to workspaces you belong to.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Automatically with groups" icon="users">
    <Note>
      User group membership is in development and available to select organizations. Contact the Ravenna team to enable it.
    </Note>

    In the workspace's **Settings > General**, under **User Group Membership**, choose **Member groups** or **Admin groups**. Ravenna adds everyone in those groups to the workspace. Groups you create in Ravenna and groups synced from your IdP both work.

    New SSO users aren't added at their first sign-in. Ravenna adds them the next time it re-syncs the workspace's member list, for example after your IdP's next sync.

    <Callout icon="link" color="#6B7280">Learn more about [user group membership](/documentation/platform/workspaces/settings#user-group-membership)</Callout>
  </Tab>
</Tabs>

To change a user's workspace role later, open them from the workspace's **Members** page, click **Edit**, and choose a **Workspace Role**. Members added through a group are managed by it, so change the workspace's groups instead.

<Callout icon="link" color="#6B7280">Learn more about [roles and access](/documentation/platform/roles-access)</Callout>

## Deactivate SSO users

When someone leaves, remove their access in your IdP and in Ravenna. Unassigning or deactivating them in your IdP stops new SSO sign-ins, but doesn't end a session they already have, and their Ravenna account stays active.

<CardGroup cols={2}>
  <Card title="Block User" icon="ban">
    <Badge color="green" size="sm" stroke>Recommended</Badge>

    Ends their access right away and keeps it blocked. Their account stays in your member list with a **Blocked** badge, so their tickets and history stay intact.
  </Card>

  <Card title="Remove" icon="user-minus">
    Takes them out of your organization and every workspace. If they can still sign in through your IdP, Ravenna adds them back as a Member the next time they sign in.
  </Card>
</CardGroup>

<Steps>
  <Step title="Unassign the user in your IdP">
    Deactivate the user, or remove them from the Ravenna application, in your IdP.
  </Step>

  <Step title="Block the user in Ravenna">
    Go to **Settings > Organization > Members**. Open the user's row actions, select **Block User**, then click **Block** to confirm.
  </Step>
</Steps>

To restore access, open the same row actions and select **Unblock User**.

## User profile attributes

Ravenna reads these attributes from your IdP only when it creates a user's account at their first sign-in. Later sign-ins don't update them.

| IdP attribute | Ravenna field |
| - | - |
| `given_name` | First name |
| `family_name` | Last name |
| `picture` | Profile photo |

Ravenna doesn't read groups, manager, or department from SSO sign-ins. To get them and keep names up to date, connect a directory or HRIS integration, such as [Okta](/integrations/okta/overview), [Google Workspace](/integrations/google-workspace/overview), [Microsoft Entra ID](/integrations/microsoft-entra/overview), [JumpCloud](/integrations/jumpcloud/overview), or [BambooHR](/integrations/bamboohr/overview).

## Review user access

Review your member list on a regular schedule:

<Checkbox
  items={[
"Block anyone who has left your organization",
"Check that each user's organization role still matches their job",
"Check that users are in the right workspaces, and that each workspace's member and admin groups are still correct"
]}
/>


## Related topics

- [Setup](/integrations/microsoft-entra/setup.md)
- [Service account setup](/integrations/jumpcloud/setup/service-account.md)
- [Get user groups with workspace assignments (for organization-level management)](/api/user-group/get-user-groups-with-workspace-assignments-for-organization-level-management.md)
- [Agent tools](/integrations/intune/agent-tools.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.