> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and Access

> Set up SSO, SCIM Provisioning, and Groups to govern how your team signs in to StackOne and what they can access.

StackOne gives your organization three tools for governing access, and they build on each other:

* **Single Sign-On (SSO)** lets members sign in through your identity provider (Okta, Microsoft Entra ID, or any SAML 2.0 IdP) instead of a StackOne password.
* **SCIM Provisioning** creates and deactivates members automatically from that same identity provider, so joiners and leavers are handled for you.
* **Groups** grant many members the same project or account access at once, so you can manage least-privilege access as a team rather than one person at a time.

A typical rollout runs in that order: connect SSO so people can sign in, add SCIM Provisioning so membership stays in step with your directory, then use Groups to grant the right access.

## Set up identity and access

<CardGroup cols={2}>
  <Card title="Manage Team" icon="user-gear" href="/secure/identity-and-access/manage-team">
    Invite members, change their roles, and remove people who leave.
  </Card>

  <Card title="Authentication" icon="key" href="/secure/identity-and-access/authentication/overview">
    Set up Single Sign-On, or sign in with a password and MFA.
  </Card>

  <Card title="Provisioning" icon="arrows-rotate" href="/secure/identity-and-access/provisioning/overview">
    Add members by invitation, at their first SSO sign-in, or from your directory over SCIM.
  </Card>

  <Card title="Groups" icon="users" href="/secure/identity-and-access/groups/overview">
    Grant a whole team the same project or account access, and change it in one place.
  </Card>
</CardGroup>

## How they fit together

* **SSO authenticates.** A verified SSO connection lets a member sign in, but it does not, on its own, place them in your organization.
* **SCIM Provisioning manages membership.** It creates and deactivates organization members from your IdP, and adds them to the projects you choose. Without it, membership comes from an invitation.
* **Groups grant access.** Once members exist, assign Groups to projects and accounts to give everyone in the group the same role, the strongest role a member holds always wins.

<CardGroup cols={2}>
  <Card title="Audit and logs" icon="list-check" href="/secure/observability">
    Review sign-in and provisioning events under Security > Logs.
  </Card>

  <Card title="Back to Secure" icon="shield-halved" href="/secure/overview">
    IP restrictions, MFA, connector scoping, and the rest of your security settings.
  </Card>
</CardGroup>