# SSO and directory sync

Single sign-on and directory sync (SCIM) are part of Enterprise. They run through WorkOS, which connects to your identity provider; Veqen never sees your users' passwords. Only owners can change them, under **Settings › SSO**.

## Set it up

1. **Link your organization.** List the email domains your people sign in with, such as `acme.com`. Public mail providers (gmail.com, outlook.com and the like) aren't accepted.
2. **Set up with your identity provider.** Each button opens WorkOS's guided setup and comes back when you're done:
   - **Set up SSO** connects your SAML or OIDC provider.
   - **Verify domains** proves you own each domain, with a DNS record. A domain counts only once it's verified; until then it changes nothing. **Check again** reads the latest state, and verification is picked up on its own when WorkOS reports it.
   - **Connect a directory (SCIM)** sends your users and groups to Veqen.
3. **Access.** Choose the role new members join with, and map directory groups to roles (the highest wins). Then, once a domain is verified and the connection is active, you can **require SSO**.

People sign in at `https://veqen-app.com/login/sso` with their work email, or from your identity provider's app dashboard.

## Just-in-time members

Someone who signs in through your SSO with an email on one of your verified domains joins the organization with the role their directory groups give, or the default role. They don't need an invitation. Nobody joins while the plan's seats are full, and nobody joins through SSO with an address outside your verified domains.

## Requiring SSO

When SSO is required for a domain:

- other sign-ins for that domain (password, Google, magic link) are turned away with a link to sign in through SSO, even when the identity provider's organization is right but the method isn't SSO;
- sessions that didn't come through SSO end right away, in every organization those people belong to;
- a domain verified later is covered as soon as it's verified.

**Owners are exempt.** They can always sign in with email, so a broken identity provider can't lock the organization out. Test SSO by signing in once yourself before you require it.

## Directory sync

With a directory connected, Veqen follows it:

- a person deactivated or deleted in the directory loses access at once, including their sessions;
- a change of groups changes their role, using your group mapping;
- a group renamed or deleted in the directory is renamed or removed from everyone in it, and their roles follow.

New people join when they first sign in through SSO; the directory doesn't create accounts on its own. Owners are never changed by the directory. Changes are applied in the order the directory made them, so a late retry can't undo a newer change.

## Next

- [Teams and roles](/docs/teams).
- [Security](/docs/security).