Company sign-in and SCIM
Configure OIDC, verify a domain, provision people with SCIM and keep the owner's sign-in available.
Single sign-on is in Team ($180 a person a year, at least 3 people). SCIM provisioning and "SSO required" need the Business plan ($360); on Team the SCIM endpoints answer 402.
In the web Account > Team > Single sign-on form, enter the issuer, client ID and client secret. Copy the redirect URI displayed there into the provider's OIDC web application. Use an HTTPS issuer; local HTTP is only available with the explicit development flag.
Okta's OIDC web application and Google Workspace must supply an ID token with email and email_verified=true. For Entra ID, use https://login.microsoftonline.com/<tenant-guid>/v2.0; common and organisations issuers are not supported. In App registration > Token configuration, add ID-token optional claims email, acct and xms_edov. Entra does not provide email_verified by default.
Entra sign-in requires a tenant member (acct=0), a domain-owner-verified email (xms_edov=true), and the signed tenant ID matching the configured issuer. The server links the immutable tenant/object IDs, never userPrincipalName. Guests and unverified domains are refused. Domain verification is an assertion by your tenant administrator; it is not an independent mailbox check. The company must also publish Switchboard's TXT proof. Live-provider acceptance is still a release gate.
The server checks RS256 or ES256 signatures, issuer, audience, authorized party where needed, nonce, token times, subject and verified email. Discovery and signing-key fetches require public HTTPS addresses, refuse redirects and connect to the checked IP with the original hostname's TLS verification. The Mac also holds a private S256 verifier for the single-use app grant; intercepting its callback URL is not enough to sign another Mac in.
Domains and required sign-in #
Add your company domain. Publish the displayed switchboard-verify=<token> TXT value at _switchboard.<domain> and press Verify. The server rechecks verified domains daily; a lost TXT record disables domain-based allocation.
Press Test with your own admin account. Only a successful test of the current configuration permits "SSO required". First sign-in can allocate a seat if the verified domain has room; an already removed person is not automatically recreated.
The owner can always request an emailed code, including during provider or DNS failure. Required SSO never removes this fallback. An operator can also run serve.py team sso-disable owner@example.com.
SCIM users #
Generate the SCIM token in Account > Team. It is shown once; Regenerate immediately invalidates the old token. Treat it as an administrative credential.
Okta: configure a SCIM connector with base URL https://<account-host>/scim/v2, bearer authentication and userName mapped to the user's company email. Enable create, update and deactivation; do not enable group push.
Entra: use Enterprise application > Provisioning > Automatic, put the SCIM base URL in Tenant URL and the token in Secret Token. Map userPrincipalName to userName and the active state to accountEnabled. Test provisioning on a pilot person before enabling it for everyone.
The implementation supports Users, active state, listing/filtering, PUT/PATCH and deletion. Groups return 501 and usernames are immutable. Removing or deactivating the owner is refused. Capacity and removed-person safeguards apply to SCIM too.