Configure Identity Provider
Connect Entra ID or Google Workspace — user import via OAuth, group-to-role mapping, deactivation on removal.
Wire your identity provider into Palveron and stop maintaining the member list by hand — users are imported from your directory, group membership maps to permission levels, and users removed from mapped groups are deactivated on the next sync.
Supported providers
| Provider | Connection | User sync |
|---|---|---|
| Microsoft Entra ID | OAuth (read-only directory scopes) | ✅ import + periodic sync |
| Google Workspace | OAuth (read-only directory scopes) | ✅ import + periodic sync |
| Okta | — | Roadmap — not yet available |
Palveron connects via a read-only OAuth authorization of your directory (users and group memberships). SCIM push provisioning is on the roadmap and not yet available — there is no SCIM endpoint or SCIM token today. If a setup guide asks you for one, it is outdated.
Setup takes about 10–15 minutes; ongoing maintenance is zero.
Generic flow (any provider)
- Open Team → Identity Provider (visible to
ownerandadminonly). - Click Connect provider and pick Entra ID or Google Workspace.
- You are redirected to your provider to authorize read-only directory access.
- Map IdP groups to Palveron permission levels.
- Click Start synchronization.
The platform imports users from every mapped group, then keeps them in sync periodically. Each user lands in the role corresponding to their IdP group.
Entra ID (Azure AD)
- In Palveron, open Team → Identity Provider → Connect → Entra ID and enter your Directory (tenant) ID.
- You are redirected to Microsoft to consent to read-only Graph scopes (
User.Read.All,GroupMember.Read.All). - The OAuth redirect URI used by the flow is
https://gateway.palveron.com/api/v1/integrations/oauth/callback— if your organization restricts consented apps, allow this URI. - Back in Palveron, assign the groups you want to sync (typically
Palveron Admins,Palveron Editors,Palveron Viewers).
Google Workspace
- In Palveron, open Team → Identity Provider → Connect → Google Workspace.
- You are redirected to Google to consent to read-only Admin Directory scopes (
admin.directory.user.readonly,admin.directory.group.readonly). A Workspace super-admin should perform this step. - The OAuth redirect URI used by the flow is
https://gateway.palveron.com/api/v1/integrations/oauth/callback.
Initial sync runs immediately after connecting; afterwards Palveron re-syncs periodically. Trigger an immediate sync with Sync now.
Map groups to Palveron levels
After the connection succeeds, Palveron lists every group it can read from the IdP. Map each to a permission level:
| IdP group (example) | → Palveron level |
|---|---|
Palveron Admins | admin |
Compliance & Risk | editor |
Engineering | viewer |
Sales | viewer |
Unmapped groups default to viewer (lowest permissions). Members of multiple groups inherit the highest mapped level.
What auto-sync does
After the IdP is connected:
- New user added to a mapped group → user appears in Palveron at the mapped level (status:
ACTIVE). - User removed from all mapped groups → user deactivated in Palveron on the next sync (cannot log in; responsibility-chain references trigger reassignment warnings).
- User moved between groups → role updated on the next sync.
- User profile updated in the IdP (display name, email) → fields update in Palveron on the next sync.
Synced users carry an IdP badge in the member list. They cannot be removed or role-changed manually — managed entirely through the IdP.
Disconnect the IdP
- Team → Identity Provider → Settings (⚙️) → Disconnect.
- Confirm.
On disconnect, synced users remain in Palveron but are converted to manually-managed users — they are no longer affected by IdP changes. Their current role is preserved. If you wanted to delete the users entirely, do so in the IdP first, let the deactivation propagate, then disconnect.
Audit trail
Every sync action (user added, role changed, deactivated) is recorded as a TEAM_* governance event. The full sync history is available under Monitoring → Governance Events.