Configure Identity Provider

Wire your identity provider into Palveron once and never touch the member list again — users sync automatically, group changes map to permission levels, and removed users are deactivated within minutes.

Supported providers

Pick the one your organization already uses for SSO. Setup takes 10-15 minutes; ongoing maintenance is zero.

Generic flow (any provider)

1. Open Team → Identity Provider (visible to owner and admin only).
2. Click Connect provider and pick Entra ID, Google Workspace, or Okta.
3. Enter credentials (provider-specific — see below).
4. Map IdP groups to Palveron permission levels.
5. Click Start synchronization.

The platform imports users from every mapped group, then keeps them in sync on the schedule above. Each user lands in the role corresponding to their IdP group.

Entra ID (Azure AD)

In Microsoft Entra

1. Go to Azure portal → Entra ID → Enterprise applications → New application → Create your own application.
2. Pick Integrate any other application you don't find in the gallery and call it Palveron.
3. Under Provisioning, set mode to Automatic. Tenant URL: https://app.palveron.com/api/v1/scim/{your-project-id}/v2. Secret token: generate one in Palveron under Team → IdP → Generate SCIM token and paste it here.
4. Under Single sign-on, configure OIDC. Redirect URI: https://app.palveron.com/api/v1/auth/callback/entra. Note the Application (client) ID, Directory (tenant) ID, and create a client secret.
5. Under Users and groups, assign the groups you want to sync (typically: Palveron Admins, Palveron Editors, Palveron Viewers).

In Palveron

Click Test connection before saving — the test calls GET /scim/v2/Users?count=1 and confirms credentials work.

Google Workspace

In Google Admin Console

1. Go to Security → API controls → Domain-wide delegation → Add new.
2. Client ID: palveron-google-sync (generated when you click Connect in Palveron). Scopes: admin.directory.user.readonly, admin.directory.group.readonly, admin.directory.user.security.
3. Create an OAuth client at APIs & Services → Credentials. Authorized redirect URI: https://app.palveron.com/api/v1/auth/callback/google.

In Palveron

Initial sync runs immediately. After that, Google Workspace polls hourly. Trigger an immediate sync with Sync now.

Okta

In Okta

1. Admin Console → Applications → Browse App Catalog → SCIM 2.0 Test App (OAuth Bearer Token) (or use Create New App → SCIM 2.0).
2. SCIM connector base URL: https://app.palveron.com/api/v1/scim/{your-project-id}/v2. Authentication mode: HTTP Header. Header name: Authorization. Value: Bearer {token-from-Palveron}.
3. Enable Push Users, Push Profile Updates, Push Groups.
4. Configure OIDC for SSO. Redirect URI: https://app.palveron.com/api/v1/auth/callback/okta.
5. Assign the application to the groups you want to sync.

In Palveron

Map groups to Palveron levels

After the connection succeeds, Palveron lists every group it can read from the IdP. Map each to a permission level:

Unmapped groups default to viewer (lowest permissions). Members of multiple groups inherit the highest mapped level.

📸 Screenshot: Group mapping table with dropdowns per group.

What auto-sync does

After the IdP is connected:

• New user added to a mapped group → user appears in Palveron at the mapped level (status: ACTIVE).
• User removed from all mapped groups → user deactivated in Palveron (cannot log in, listed responsibility-chain references trigger reassignment warnings).
• User moved between groups → role updated; takes effect within ~5 minutes (Entra / Okta) or up to 1 hour (Google Workspace).
• User profile updated in IdP (display name, email) → fields update in Palveron on next sync.

Synced users carry an IdP badge in the member list. They cannot be removed or role-changed manually — managed entirely through the IdP.

Disconnect the IdP

1. Team → Identity Provider → Settings (⚙️) → Disconnect.
2. Confirm.

Audit trail

Every sync action (user added, role changed, deactivated) is recorded as a TEAM_* governance event. The full sync history is available under Monitoring → Governance Events.