Skip to main content
Directory sync lets your identity provider manage who belongs to your Odin organisation and with what role, over SCIM 2.0. When someone joins, changes team or leaves in your IdP, Odin follows within seconds. Set it up from Organisation Settings → Single Sign-On → Directory synchronisation. It needs an active SSO connection first.

​
Create the directory

1

Choose the provider

Pick the Directory provider: Okta SCIM 2.0, Microsoft Entra ID SCIM 2.0, OneLogin SCIM 2.0, JumpCloud SCIM 2.0 or Generic SCIM 2.0. Optionally rename the Directory name.
2

Choose who manages roles

Under Roles, leave Directory manages roles off to manage roles in Odin, or turn it on and enter the IdP group for each role. See Roles. You can change this later.
3

Create it and copy the credentials

Select Create SCIM directory. Odin shows the SCIM endpoint and SCIM bearer token once. Copy both into your IdP’s provisioning settings straight away.
4

Turn on provisioning in your IdP

Enable creating users, updating user attributes and deactivating users. If the directory manages roles, also push the mapped groups. The identity provider guides have the exact steps.
The bearer token cannot be shown again. If you lose it, remove the directory and create a new one, then update your IdP. Treat the token like a password: anyone holding it can provision users into your organisation.

​
What directory sync does

Deprovisioning removes access to your organisation only. Odin keeps the person’s global account, so other organisations they belong to are unaffected.
Directory sync only adds people whose email is on one of the connection’s verified domains. Other addresses in the directory are ignored. Removals always apply, so access can always be withdrawn.

​
Access

By default, anyone your IdP lets sign in to Odin joins your organisation the first time they sign in with SSO, even if the directory has not provisioned them yet. Turn on Only directory-provisioned people can join to make the directory the only way in. Odin then refuses an SSO sign-in from anyone who is not already in your organisation, with “you have not been added yet”. It also stops automatic joining by email domain.
  • People already in your organisation, including people you invite, sign in as before.
  • The setting saves as soon as you switch it, and needs a directory. Removing the directory turns it off.
  • Use it when IdP app assignment and SCIM provisioning can drift apart, for example when SSO is assigned to everyone but provisioning is scoped to a group.

​
Roles

Directory manages roles decides who controls roles:
  • Off (the default): the directory only adds and removes people. New people join as Members, and you change roles in Team Management. Directory sync never changes a role.
  • On: roles follow IdP groups, as described below.

​
Role mapping

With Directory manages roles on, enter one IdP group name for each Odin role:
  • Odin administrators → Admin
  • Odin members → Member
  • Odin read-only users → Read only
Group names are matched without regard to case. If someone is in several mapped groups, they get the highest role: Admin, then Member, then Read only. People in no mapped group are Members. Directory sync never assigns or changes the Owner role. Owners stay under your control in Team Management.
Role mapping applies to everyone in the directory as soon as you save it. An existing Admin who is not in your mapped admin group becomes a Member. Add your admins to that group in the IdP before you save. Turning roles on with no groups entered makes every directory user a Member.Role changes from directory sync take effect immediately and sign the person out, so they sign in again with their new role.
When you select Save role settings, Odin first shows who the change affects, with each person’s role change, additions and removals, under Apply role changes?. Nothing changes until you select Apply changes. If nobody’s access changes, the settings save straight away. Odin refuses settings that would remove your own admin access, or leave the organisation with no Owner or Admin, and shows why next to the button. Add the right people to your admin group in the IdP, or turn off Directory manages roles, then save again.
While Directory manages roles is on, a role you change by hand in Team Management for a directory-managed person is overwritten at the next sync. Turning it off keeps everyone’s current role.
Selecting Save role settings saves and immediately re-applies the directory, with names, additions and deactivations, to every user in it. Use it to bring Odin back in line after changing settings or pausing the directory.

​
Managing the directory

Removing the SSO connection also removes its directory.