> ## Documentation Index > Fetch the complete documentation index at: https://docs.getbluejay.ai/llms.txt > Use this file to discover all available pages before exploring further. # SSO and User Provisioning > Sign in with SSO and sync your team with SCIM SSO and SCIM are available to enterprise organizations, and an organization admin sets them up under **Settings → Security → Organization**. They work with Okta, Microsoft Entra ID, OneLogin, and any other SAML 2.0 and SCIM 2.0 identity provider (IdP). ![The Organization tab of the Security settings, with SSO turned on and the SCIM section below it](https://mintcdn.com/bluejay/eKcFBkjZX47pI8Ss/images/security-organization.png?fit=max\&auto=format\&n=eKcFBkjZX47pI8Ss\&q=85\&s=77678818dcfc39262a232a368a498818) ## Single sign-on (SAML) **1. Create a SAML app in your IdP** Create a SAML 2.0 application named Bluejay with these values: | Field | Value | | - | - | | Single sign-on URL (ACS URL) | `https://auth.getbluejay.ai/auth/v1/sso/saml/acs` | | Audience URI (SP Entity ID) | `https://auth.getbluejay.ai/auth/v1/sso/saml/metadata` | | Name ID format | `EmailAddress` | | Application username | Email | **2. Assign people** Assign the app to everyone who should have Bluejay access. **3. Turn on SSO in Bluejay** In **Settings → Security → Organization → Single Sign-On (SSO)**, paste your IdP's metadata URL (or the metadata XML) and the email domains that should use SSO. ![The Single Sign-On (SSO) settings with the toggle on, a SAML metadata URL, and example.com as the email domain](https://mintcdn.com/bluejay/eKcFBkjZX47pI8Ss/images/sso-settings.png?fit=max\&auto=format\&n=eKcFBkjZX47pI8Ss\&q=85\&s=86f4dc53408e723c726d348e3598c8e8) **4. Sign in** Your team clicks **Continue with SSO** on [app.getbluejay.ai](https://app.getbluejay.ai) and enters their work email, or opens the Bluejay tile in your IdP. > [!NOTE] > > Once SSO is on, signing up with a password on those domains sends people to your IdP instead. Password and Google accounts that already exist keep working until you remove them. SSO signs people in; it does not decide who belongs to your organization. Before someone's first SSO sign-in, make sure they are already a member or have a pending invite. Invite people from the **Team** page, or let your IdP do it with SCIM below. A person's first SSO sign-in creates a new Bluejay account for them in your organization. If they also had a password or Google account, remove the old one from the **Team** page once SSO works for them. ## User provisioning (SCIM) With SCIM, assigning someone to the Bluejay app in your IdP gives them access, and removing them takes it away. Nobody has to invite or remove people by hand. Turn on SSO first. **1. Generate a token in Bluejay** In **Settings → Security → Organization → User provisioning (SCIM)**, click **Generate token**. Copy the base URL and the token. The token is shown once. ![The User provisioning (SCIM) settings showing the SCIM base URL and a Generate token button before any token exists](https://mintcdn.com/bluejay/eKcFBkjZX47pI8Ss/images/scim-token.png?fit=max\&auto=format\&n=eKcFBkjZX47pI8Ss\&q=85\&s=2cfb7f661ae86d63280c931422ffa2f4) | Setting | Value | | - | - | | SCIM base URL | `https://api.getbluejay.ai/v1/scim` | | Authentication | Bearer token: `Authorization: Bearer `. Sending the token alone in `Authorization` also works. | **2. Connect your IdP** On the Bluejay app in your IdP, turn on SCIM provisioning. Enter the base URL and the token, set the unique identifier to `userName` (email), and test the connection. **3. Choose what syncs** Turn on **Create users**, **Update user attributes**, and **Deactivate users**. **4. Assign people** Assign people, or groups of people, to the Bluejay app. ### What happens | In your IdP | In Bluejay | | - | - | | Assign a person | They can sign in with SSO right away. No invite email is sent. | | Change their name | Their name updates in Bluejay. | | Unassign or deactivate them | They lose access to your organization on their next request: they are signed out and their API keys in your organization are revoked. Their access to other organizations is unaffected. | | Assign them again | They can sign in again. Their work stays in your organization. | ### Details * Everyone provisioned joins as a **Member**. Change roles on the **Team** page. * Only emails on your organization's SSO domains can be provisioned. * Groups are not synced as Bluejay roles or workspaces. Assigning a group to the app provisions each person in it. * **Regenerate token** replaces the token. The old one stops working right away, so update your IdP. **Revoke** stops syncing, and people who already have access keep it. ### Supported endpoints Bluejay implements SCIM 2.0 users: `GET`, `POST`, `PUT`, `PATCH`, and `DELETE` on `/Users`, with `userName eq` and `externalId eq` filters, plus `/ServiceProviderConfig`, `/Schemas`, and `/ResourceTypes`. Paths are relative to the base URL, so users live at `https://api.getbluejay.ai/v1/scim/Users`. SCIM uses its own token, not a Bluejay API key. Full request and response details are in the [API reference](/api-reference/endpoint/list-scim-users.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.