Directory Sync (SCIM)
Let your identity provider create, update, and deactivate Muin members automatically. Issue a provisioning token, map IdP groups to Muin roles, and see how many members each mapping affects.
Directory sync (Settings → Security → Directory sync) lets your identity provider manage who is in your Muin workspace. When someone joins, they appear. When they leave, their access ends · without anyone remembering to do it.
Directory sync is an Enterprise capability, and it builds on Single Sign-On (SAML): turn SSO on first.
Setting it up
- Turn on single sign-on. Directory sync provisions the accounts that SSO then signs in.
- Issue a provisioning token. The token is shown once, at the moment you create it · Muin stores only a hash, so it cannot be shown again. Copy it into your IdP then; if it is lost, rotate rather than hunt for it.
- Give your IdP the base URL shown beside the token.
- Map IdP groups to Muin roles. Each mapping shows how many of today’s members it affects, so you can see the blast radius before you save.
- Turn directory sync on.
What your IdP can do
| Your IdP does | Muin does |
|---|---|
| assigns the app to a person | creates the member, with the roles their groups map to |
| changes a name or email | updates the member |
| changes group membership | grants and revokes the mapped roles |
| unassigns or deactivates | deactivates the member and ends their sessions |
A group with no mapping grants nothing. Someone who is only in unmapped groups gets the default role and nothing more: mapping is how a group becomes permission.
Deactivation is real
A deprovisioned member cannot sign in, and their existing sessions end. Their employment record is ended too: their end date is set and they stop counting as a current employee, so headcount, team lists, benefits eligibility and reporting all agree with your directory instead of showing somebody who has already left.
Their records stay: deactivating a person never deletes the work they did, which is what an audit of last year needs.
If your organization needs the employment side handled separately from the identity side, say so before you turn directory sync on: the two moving together is the default and it is deliberate.
Rotating and revoking the token
- Rotate issues a new token and invalidates the old one: use it when a token may have been exposed, or on your normal credential schedule.
- Revoke ends directory sync entirely. Your IdP stops being able to change anything, and existing members are left exactly as they are.
Both ask you to confirm first, because both interrupt provisioning until your IdP has the new value.
Related
- Single Sign-On (SAML): the sign-in half of the same IdP connection.
- Team: the member list, where directory-managed members are labelled as such.
- Audit Logs & Security: every provisioning action is recorded.