> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fixaeo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on and SCIM

> Connect your identity provider to FixAEO with OIDC single sign-on and SCIM directory sync.

If your company signs people in through Okta, Microsoft Entra ID, OneLogin, or another identity provider, FixAEO can hand sign-in and account provisioning to it. Single sign-on (SSO) lets your team reach FixAEO through your provider. Directory sync (SCIM) lets your provider add and remove workspace members for you.

Both are **Enterprise-only**, and both are set up by a workspace administrator. You need the manage permission on the workspace, and the plan has to be Enterprise. If either isn't true, the section explains that instead of showing the setup.

<Note>
  FixAEO speaks **OpenID Connect (OIDC)** only. SAML is not supported. If your identity provider can only offer a SAML app for us, that's a hard no today, not a coming-soon. Any standards-compliant OIDC provider works — Okta, Microsoft Entra ID, OneLogin, and the rest.
</Note>

You find both controls under **Settings → Enterprise**. There are two cards: **Single sign-on** and **Directory sync**. They're independent — turn on either one without the other.

## Set up single sign-on

Have your provider's OIDC issuer URL, client ID, and client secret ready before you start. You'll create the app in your identity provider, then paste its details here.

<Steps>
  <Step title="Enter your OIDC details">
    In the **Single sign-on** card, fill in your **Company domain** (for example, `company.com`), the **OIDC issuer URL**, **Client ID**, and **Client secret** from your provider. Click **Save configuration**.
  </Step>

  <Step title="Copy the callback URL into your provider">
    The card shows a **Provider callback URL** (`https://api.fixaeo.com/auth/sso/callback`). Copy it and paste it into your identity provider's app as the redirect or callback URL.
  </Step>

  <Step title="Publish the DNS record and verify">
    FixAEO shows a TXT record to publish — a **Name** that looks like `_fixaeo-sso.company.com` and a **Value**. Add it at your DNS provider, then click **Verify DNS**. This proves you control the domain.
  </Step>

  <Step title="Test the sign-in">
    Click **Test sign-in** and complete a real sign-in through your provider as the admin. This confirms the connection works before anyone relies on it.
  </Step>

  <Step title="Enable SSO">
    Click **Enable SSO**. People at your verified domain can now sign in to FixAEO through your identity provider.
  </Step>
</Steps>

A few things worth knowing once SSO is on:

* **One domain binds to one workspace.** A company domain can be connected to a single FixAEO organization, not several.
* **SSO never creates access on its own.** Someone has to already be a member — invited by a teammate or provisioned by directory sync — before they can sign in through your provider. A valid company login is not, by itself, a FixAEO account.
* **Turning SSO off keeps your configuration.** If you disable it, the saved OIDC details stay, so you can re-enable later without typing them again.

<Warning>
  Always run **Test sign-in** before **Enable SSO**, and keep at least one admin who can still sign in another way — a magic link or Google. Enabling SSO doesn't remove those sign-in methods, so a mistyped issuer URL or a rotated client secret can't lock your whole workspace out.
</Warning>

## Set up directory sync (SCIM)

Directory sync uses SCIM 2.0. Your identity provider becomes the source of truth for who belongs to the workspace — it adds people when you assign them and removes them when you deprovision them.

<Steps>
  <Step title="Choose your provider">
    In the **Directory sync** card, pick your **Identity provider** — Okta, Microsoft Entra ID, OneLogin, or Custom SCIM.
  </Step>

  <Step title="Create the token">
    Click **Enable and create token**. FixAEO shows a **SCIM base URL** and a **bearer token**.
  </Step>

  <Step title="Copy both into your provider">
    Paste the base URL and bearer token into your identity provider's provisioning settings. The **token is shown once** — copy it now. If you lose it, use **Rotate token** to issue a new one, which replaces the old.
  </Step>

  <Step title="Assign users">
    Assign the users or groups you want in your identity provider. FixAEO provisions them into the workspace as they're assigned.
  </Step>
</Steps>

### How provisioning behaves

* **New members get the Member role and access to all brands.** Directory sync controls who's in and out; roles and per-brand access stay editable inside FixAEO afterward.
* **Provisioned members count toward your seat limit,** the same as invited teammates. If a sync would push you past your seats, FixAEO refuses that add rather than overfilling — raise your seats or free some up, then it syncs.
* **Deactivating a user removes them from this workspace only.** Their personal FixAEO account, and any other workspace they belong to, is untouched. Directory removal never deletes an account.
* **The workspace owner and the last active admin can't be removed by directory sync,** so an errant deprovision can't leave the workspace with no one in charge.

<Note>
  Rotating the SCIM token stops your provider from syncing until you paste the new token in, so plan a rotation for a quiet moment. The same is true if you disable directory sync: your provider can no longer add or remove members until you turn it back on.
</Note>

## Related

<CardGroup cols={2}>
  <Card icon="users" title="Team and workspaces" href="/team-and-workspaces">
    Roles, seats, invites, and how a workspace is organized.
  </Card>

  <Card icon="shield-halved" title="Security and privacy" href="/security">
    Sign-in methods, two-factor, and what FixAEO encrypts.
  </Card>

  <Card icon="credit-card" title="Plans and limits" href="/plans-and-limits">
    What Enterprise includes, including seats and engines.
  </Card>

  <Card icon="gauge" title="Usage" href="/usage">
    Seat counts, credits, and per-member activity.
  </Card>
</CardGroup>