Applies to: Teams with enterprise single sign-on (SSO)

Teams that sign in to Uniform with SSO can now manage roles from the same directory they use for every other business app. Map a directory group to a Uniform role once. From then on, joining or leaving that group grants or removes the role, with no invitations to send and no roles to edit by hand. If your directory is connected with SCIM, deactivating a user also revokes their Uniform access, including their personal access tokens.

What's new

• Group-mapped roles. Mark a role as Managed by identity provider and enter the name of a directory group. Members of that group receive the role automatically, scoped to the projects you choose through project policies.
• Inbound SCIM 2.0. Connect your identity provider to sync users, profiles, and group membership into Uniform. Okta, Microsoft Entra ID, and any provider with outbound SCIM 2.0 are supported.
• SAML group attribute. If you can't use SCIM, send groups in your SAML sign-in using the attribute http://schemas.xmlsoap.org/claims/Group. If your provider uses a different attribute name, Uniform can map it for you.
• Directory-managed team administration. Designate one directory group whose members administer your Uniform team. Uniform configures this for you.
• Automatic offboarding with SCIM. When your directory deactivates or deletes a user, Uniform revokes their access right away, and their personal access tokens stop granting permissions.
• Personal access tokens follow their owner. If a user loses a role in your directory, any personal access token carrying that role loses it too.
• Audit trail. The team audit log (Security > Audit Log) records every role granted or removed, along with the group and connection behind it. SSO entries are kept for 365 days.
• More than one directory per team. A team can be connected to more than one SSO connection, which helps after a merger or acquisition.

Before you start

• Enterprise SSO must already be set up for your team.
• Project policies must be enabled for your team. Group-mapped roles grant access only through project policies, so each mapped role needs a policy on every project it should reach. A mapped role with no policy on a project grants no access there.
• An identity admin on your side who can configure Okta, Entra ID, or your SAML provider.

How to get started

1. Contact your Uniform account team to schedule a short kickoff with your identity team.
2. Agree on the directory groups for each level of access, and the group that will administer your team.
3. Follow the setup steps in the Single sign-on integration guide. Uniform handles the connection on our side and activates group mapping on your team.
4. Your team admins create mapped roles in Security > Roles and set their project policies.

Good to know

• When changes apply. With SCIM, group changes apply the next time the user opens Uniform, once your identity provider has sent them. With a SAML group attribute, changes apply at the user's next sign-in.
• Group names must match exactly. They are case-sensitive. Some providers send an ID instead of a display name; confirm which yours sends before creating roles.
• Sync only what Uniform needs. Send Uniform only the users and groups that should have access, never your whole directory.
• Sign-in starts from Uniform. Signing in from your identity provider's dashboard isn't supported. For a dashboard tile, use a bookmark to https://uniform.app/?login_hint=you@yourcompany.com.
• Keep a backup admin. We recommend one team admin who signs in with a password outside SSO, so administration never depends on a directory group being set up correctly.
• Existing roles keep working. Roles you assigned by hand before turning on group mapping stay in place until a team admin removes them.

Group mapping is optional. Teams can keep using SSO for sign-in only and manage roles in Uniform as they do today.