> ## Documentation Index
> Fetch the complete documentation index at: https://www.latitude.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Directory sync (SCIM)

> Keep your team's members and roles in sync with your identity provider.

Directory sync connects your identity provider to your Latitude.sh team over SCIM. When someone joins, changes roles, or leaves your company, their [team membership](/docs/teams/members) follows automatically, so you don't have to invite or remove people by hand.

Directory sync works on its own or together with [SAML Single Sign-On (SSO)](/docs/teams/sso). SSO controls how members sign in; directory sync controls who is on your team and which role they have.

<AccordionGroup>
  <Accordion title="Supported directory providers">
    * Okta
    * Microsoft Entra ID
    * Google Workspace
    * OneLogin
    * JumpCloud
    * PingFederate
    * Rippling
    * CyberArk
    * Any SCIM 2.0 provider
  </Accordion>
</AccordionGroup>

**Pricing**: \$125/month.

## Setting up directory sync

**Prerequisites**:

* Your team must be verified.
* You must be the team Owner or an Administrator.

### Step 1: Purchase directory sync

<Steps>
  <Step title="Navigate to directory sync settings">
    From the [dashboard](https://www.latitude.sh/dashboard), navigate to **Settings** → **Members & access** → **SSO & Directory Sync** tab.
  </Step>

  <Step title="Open directory sync setup">
    In the **Directory sync (SCIM)** row, click **Set up**.
  </Step>

  <Step title="Complete the purchase">
    Click **Set up** to complete the purchase.
  </Step>
</Steps>

### Step 2: Connect your directory

After purchasing, the **Directory sync (SCIM)** row shows a **Pending** status. Click **Complete setup** to open the guided setup in a new tab, then select your identity provider and follow the steps to connect your directory.

During the guided setup, map your identity provider's groups to Latitude.sh roles: **Administrator**, **Collaborator**, or **Billing**. These groups decide each member's role on your team. See [Roles](/docs/teams/members#roles) for what each role can do.

Once the connection is complete, the row shows a **Connected** status and your directory starts syncing.

## Roles

Your identity provider's groups decide each member's role:

* A user in a mapped group gets that group's role.
* A user who isn't in any mapped group gets the **Collaborator** role.
* When a user moves to a different group, their role changes to match.

To change a member's role, change their groups in your identity provider. Role changes made in the dashboard are replaced the next time your team syncs with your directory.

## How syncing works

Members are matched to directory users by email address. As your identity provider reports changes, Latitude.sh applies them to your team:

| In your identity provider | On your Latitude.sh team |
| - | - |
| A user is active in the directory | They're added to the team with the role from their groups |
| A user's groups change | Their team role is updated to match |
| A user is deactivated or removed from the directory | They're removed from the team |
| A user's email changes | The new email is added as a new member and the previous email is removed from the team |

An email change creates a new Latitude.sh user. The previous account, including its password, isn't carried over to the new email.

Changes usually reach your team within moments. Latitude.sh also compares your team with your directory periodically to keep them consistent.

The team Owner is never changed or removed by directory sync.

Members added by directory sync can sign in right away.

## Adding and removing members

Once directory sync is connected, your directory decides who is on your team. Members can't be invited manually. To add someone to your team, add them to your directory.

Members who were on your team before you connected your directory, and aren't in it, aren't removed automatically. Instead, the **Directory sync (SCIM)** row shows that your team differs from the directory and offers a **Review** link. Click **Review** to see the members that would be added, have their role changed, or be removed to match your directory, then click **Apply** to make those changes to your team.

## Managing directory sync

To manage your directory, click the **…** menu in the **Directory sync (SCIM)** row and select **Manage**. This opens the directory sync management page in a new tab, where you can update how your identity provider's groups map to roles and change other directory settings.

If the connection needs attention, the row shows its status and the action to fix it:

* **Validating**: Finish connecting your identity provider. Click **Complete setup**.
* **Invalid credentials**: Update the credentials for your identity provider. Click **Update**.
* **Not connected**: Complete the setup to resume syncing. Click **Complete setup**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.