Directory sync (SCIM)

Directory sync connects your identity provider to your Latitude.sh team over SCIM. When someone joins, changes roles, or leaves your company, their team membership follows automatically, so you don’t have to invite or remove people by hand. Directory sync works on its own or together with SAML Single Sign-On (SSO). SSO controls how members sign in; directory sync controls who is on your team and which role they have. Pricing: $125/month.

​

Setting up directory sync

Prerequisites:

• Your team must be verified.
• You must be the team Owner or an Administrator.

​

Step 1: Purchase directory sync

​

Step 2: Connect your directory

After purchasing, the Directory sync (SCIM) row shows a Pending status. Click Complete setup to open the guided setup in a new tab, then select your identity provider and follow the steps to connect your directory. During the guided setup, map your identity provider’s groups to Latitude.sh roles: Administrator, Collaborator, or Billing. These groups decide each member’s role on your team. See Roles for what each role can do. Once the connection is complete, the row shows a Connected status and your directory starts syncing.

​

Roles

Your identity provider’s groups decide each member’s role:

• A user in a mapped group gets that group’s role.
• A user who isn’t in any mapped group gets the Collaborator role.
• When a user moves to a different group, their role changes to match.

To change a member’s role, change their groups in your identity provider. Role changes made in the dashboard are replaced the next time your team syncs with your directory.

​

How syncing works

Members are matched to directory users by email address. As your identity provider reports changes, Latitude.sh applies them to your team: An email change creates a new Latitude.sh user. The previous account, including its password, isn’t carried over to the new email. Changes usually reach your team within moments. Latitude.sh also compares your team with your directory periodically to keep them consistent. The team Owner is never changed or removed by directory sync. Members added by directory sync can sign in right away.

​

Adding and removing members

Once directory sync is connected, your directory decides who is on your team. Members can’t be invited manually. To add someone to your team, add them to your directory. Members who were on your team before you connected your directory, and aren’t in it, aren’t removed automatically. Instead, the Directory sync (SCIM) row shows that your team differs from the directory and offers a Review link. Click Review to see the members that would be added, have their role changed, or be removed to match your directory, then click Apply to make those changes to your team.

​

Managing directory sync

To manage your directory, click the … menu in the Directory sync (SCIM) row and select Manage. This opens the directory sync management page in a new tab, where you can update how your identity provider’s groups map to roles and change other directory settings. If the connection needs attention, the row shows its status and the action to fix it:

• Validating: Finish connecting your identity provider. Click Complete setup.
• Invalid credentials: Update the credentials for your identity provider. Click Update.
• Not connected: Complete the setup to resume syncing. Click Complete setup.