# SAML SSO and SCIM

Sign your team in through Okta, Microsoft Entra ID or any SAML 2.0 identity provider, and provision seats with SCIM 2.0.

SAML single sign-on and SCIM provisioning are included on Platform and Enterprise. An owner or admin sets both up under **Settings → Security** in the dashboard. There is no separate SSO fee.

## SAML single sign-on

Runstamp is the service provider. Settings → Security shows the four values your identity provider asks for:

| Field | Value |
| --- | --- |
| Entity ID (audience) | shown in Settings → Security |
| ACS URL (single sign-on URL) | shown in Settings → Security |
| Metadata URL | shown in Settings → Security |
| Login URL for your users | `https://runstamp.com/auth/login?sso=1` |

1. In your identity provider, create a SAML 2.0 app with the entity ID and ACS URL. Send the user's email as the NameID (`emailAddress` format) and, if you map roles, a `groups` attribute.
2. In Settings → Security, add the connection: paste the IdP metadata URL or XML, list the email domains it covers, and name the groups that make someone an admin.
3. People on those domains choose **Continue with SSO** on the login page. Someone in an admin group joins as an admin; everyone else joins as a member.

A sign-in from a domain that isn't on the connection is refused and leaves no session.

## SCIM 2.0 provisioning

Create a SCIM token in Settings → Security. The token is shown once; Runstamp stores only its hash. Point your identity provider at:

```text
Base URL:  https://runstamp.com/api/scim/v2
Auth:      Bearer token (the scim_ token you created)
```

Supported: `Users` (create, filter by `userName`, read, `PATCH` active, delete) and `Groups` (create with members, delete). Setting a user inactive removes their seat; setting them active again restores it. Deleting a user is idempotent. Revoke a token in Settings → Security and every request with it gets `401`.

## What is not included

OpenID Connect (OIDC) enterprise sign-in is not offered.