> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Organization Rollout > Take StackOne from a pilot team to the whole organization, with your identity provider deciding who gets in and each system's owner deciding who connects. ![Flow diagram. An identity provider such as Okta or Microsoft Entra sends users and groups into StackOne, and an AI platform sends tool calls over MCP. Inside StackOne, three checks run in order: who gets in, set by SSO, JIT and SCIM; who can link accounts, set by Connector Profile Access; and who can use each account, set by Shared Accounts and groups. A user who holds a role on the linked account has their agent act through it. A user with no role finds the account unavailable to their agent. A user deactivated in the identity provider has their access suspended and is signed out. Below StackOne, an arrow labeled Logs API leads to your SIEM, which receives the logs through a collector you run.](https://mintcdn.com/stackone-60/0xPgvlJBqadL8yIi/images/secure/identity-and-access/organization-rollout-flow.svg?fit=max\&auto=format\&n=0xPgvlJBqadL8yIi\&q=85\&s=dda6ad2d7f7fd9f05641efe932dc36a5) Rolling StackOne out to the whole organization gives everyone the same MCP connection, with access set by your identity provider (IdP) and by the people who own each system. The IdP decides who is in the organization. Groups carry access to projects, connector profiles and linked accounts. Each system's owner decides who can link accounts to it, and who can use the account they linked. StackOne logs every tool call and setup change. The Logs API hands those logs to your security information and event management (SIEM) system. > [!NOTE] > > These settings control access to StackOne. They never change permissions inside a connected provider. ## What each part decides | Part | Decides | | - | - | | [Single Sign-On](https://docs.stackone.com/secure/identity-and-access/authentication/sso/overview) | Users sign in through the IdP, and password sign-in stops once you require SSO. | | [Just-in-Time Provisioning](https://docs.stackone.com/secure/identity-and-access/manage-team/jit.md) | Users the IdP assigns join the first time they sign in. | | [SCIM Provisioning](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/overview) | The IdP adds users, and suspends them when it deactivates them. | | [Groups](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/groups.md) | Which projects, connector profiles and linked accounts a team reaches. Synced groups follow the IdP's membership. | | [Connector Profile Access](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/connector-profile-access.md) | Who can link accounts through a connector profile. | | [Shared Accounts](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/shared-accounts.md) | Who can act through an account another user linked. | ## Choose how users join Just-in-Time Provisioning and SCIM Provisioning can run on the same SSO connection: | | Just-in-Time Provisioning | SCIM Provisioning | | - | - | - | | Adds a user | At their first SSO sign-in. | When the IdP assigns them. | | Ends a user's access | Never. Disable them in StackOne. | When the IdP deactivates or unassigns them. | | Syncs groups | No. | Yes. | | Setup guides | Okta, Microsoft Entra, and other SAML 2.0 providers. | Okta and Microsoft Entra. | Use SCIM Provisioning wherever the IdP supports it, so a user the IdP deactivates loses access to StackOne without a separate step. > [!NOTE] > > SCIM Provisioning is only available on certain plans. See [plans and pricing](https://www.stackone.com/pricing/). ## Roll out access Run these steps as an **Organization Admin**, with admin access to the StackOne application in the IdP. Keep provisioned access to the projects every user needs, and give each team the rest through its group. SCIM Provisioning applies provisioned access again on every update from the IdP, so a project you remove from a user comes back. **1. Connect the identity provider** > [!NOTE] > > SAML SSO is only available on certain plans. See [plans and pricing](https://www.stackone.com/pricing/). Follow the guide for your IdP to create the SAML app, register it in StackOne and verify the email domain your users sign in with: > [card] [Okta](https://docs.stackone.com/secure/identity-and-access/authentication/sso/okta.md) > [card] [Microsoft Entra ID](https://docs.stackone.com/secure/identity-and-access/authentication/sso/microsoft-entra.md) > [card] [Other SAML 2.0 provider](https://docs.stackone.com/secure/identity-and-access/authentication/sso/saml-generic.md) **2. Open the SSO connection** 1. In the StackOne dashboard, go to [**Organization > Security > SSO**](https://app.stackone.com/organization/security/sso). 2. Open the verified SSO connection. 3. Select the **Provisioning** tab. **3. Choose projects and roles** 1. On the **Provisioned access** card, select **Manage access**. 2. Pick the projects new users should join. 3. Choose a role for each one. See [Project Roles](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/project-roles.md). 4. Select **Save changes**. Provisioned access applies to users added by both Just-in-Time Provisioning and SCIM Provisioning. ![The Provisioned access panel with a project checked and its own role dropdown set to Viewer, and a note that the organization role is set separately.](https://mintlify.s3.us-west-1.amazonaws.com/stackone-60/images/secure/identity-and-access/manage-team/provisioned-access.png) **4. Enable JIT** On the **Just-in-time provisioning** card, select **Enable JIT**. See [Just-in-Time Provisioning](https://docs.stackone.com/secure/identity-and-access/manage-team/jit.md) for when a user isn't added. **5. Link SCIM and copy the credentials** 1. On the **Directory Sync** card, select **Link SCIM**. 2. In the **SCIM Details** section, copy the **SCIM base URL** and the **Provisioning token**. You paste both into the IdP. ![The Provisioning tab on an SSO connection, showing the Provisioned access, Just-in-time provisioning, and Directory Sync cards with their Manage access, Enable JIT, and Link SCIM actions.](https://mintlify.s3.us-west-1.amazonaws.com/stackone-60/images/secure/identity-and-access/manage-team/scim/directory-sync-card.png) ![The Directory Sync panel showing the SCIM base URL and the masked provisioning token with a Regenerate action.](https://mintlify.s3.us-west-1.amazonaws.com/stackone-60/images/secure/identity-and-access/manage-team/scim/link-scim.png) > [!WARNING] > > The token is only shown once. Store it somewhere safe before you close the panel. To replace a lost or leaked token, see [Rotate the token](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/overview#rotate-the-token). **6. Turn on provisioning in the IdP** Paste the **SCIM base URL** and the **Provisioning token** into the IdP, then assign the users who should join: > [tab] Okta > > 1. Follow [Configure provisioning in Okta](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/okta.md#configure-provisioning-in-okta). > 2. Follow [Assign members in Okta](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/okta.md#assign-members-in-okta). > [tab] Microsoft Entra > > 1. Follow [Configure provisioning in Microsoft Entra](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/microsoft-entra.md#configure-provisioning-in-microsoft-entra). > 2. Follow [Assign users and groups](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/microsoft-entra.md#assign-users-and-groups). **7. Push each team's group** 1. In StackOne, create an empty group with the same name as the directory group, and assign it to the team's projects. See [Prepare the access before you push](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/groups.md#prepare-the-access-before-you-push). 2. Push the directory group from the IdP. The pushed group takes over the empty one and keeps its projects. > [tab] Okta > > Push the group from the app's **Push Groups** tab. See [Push groups](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/okta.md#push-groups). > [tab] Microsoft Entra > > Provision the groups assigned to the application. See [Provision groups](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/microsoft-entra.md#provision-groups). On the **Groups** tab of [**Organization > Manage Team**](https://app.stackone.com/organization/manage_team), each pushed group carries a **Synced** tag. To give a group more projects later, see [Assign a group to a project](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/groups.md#assign-a-group-to-a-project). ![Project Settings > Access with the Users / Groups switch set to Groups, showing each assigned group with its role and a Revoke action.](https://mintcdn.com/stackone-60/-12WgWSBkcI2a_M3/images/secure/identity-and-access/groups/project-access-groups.png?fit=max\&auto=format\&n=-12WgWSBkcI2a_M3\&q=85\&s=65424e458aa8615121dc03caae084415) A project's Access view, with groups and their project roles **8. Restrict sensitive connector profiles** > [!NOTE] > > Connector Profile Access is only available on certain plans. See [plans and pricing](https://www.stackone.com/pricing/). When only one team should connect to a provider, such as a payroll system, switch the connector profile to **Restricted** on its **Access** tab and grant the team's group **Connector Profile Member**. Everyone else in the project can no longer link accounts through it. See [Restrict a connector profile](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/connector-profile-access.md#restrict-a-connector-profile). ![A connector profile's Access tab set to Restricted, explaining that only the listed users and groups can link new accounts while already-linked accounts stay connected, above a user roster with Member and Admin roles and Revoke buttons](https://mintcdn.com/stackone-60/7q6p2Npl6DvxPD4_/images/secure/connector-profile-access-restricted.png?fit=max\&auto=format\&n=7q6p2Npl6DvxPD4_\&q=85\&s=f4a6cfb8825783d07599d5fd5832a585) A connector profile restricted to the users and groups granted on it To have new connector profiles in a project start **Restricted**, change the project's [default access](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/connector-profile-access.md#the-default-for-new-connector-profiles). **9. Share accounts a team works through** When a team acts through one login, such as a support mailbox, the user who linked the account grants the team's group **Account Member** on the account's **Access** tab. Linking an account makes that user its **Account Admin**. See [Assign a group to an account](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/groups.md#assign-a-group-to-an-account). **10. Require SSO** > [!NOTE] > > Requiring SSO is only available on certain plans. See [plans and pricing](https://www.stackone.com/pricing/). Once assigned users can sign in through the IdP, require SSO so that password sign-in stops working. Test a sign-in first, as [Require SSO](https://docs.stackone.com/secure/identity-and-access/authentication/sso/overview#require-sso) describes, because enforcement locks out anyone the IdP can't authenticate. ## When someone leaves Deactivate or unassign the user in the IdP. With SCIM Provisioning linked, their access to the organization is suspended, they leave every synced group, and they're signed out. Their agents can no longer act through StackOne. Their own accounts inside each provider are managed in that provider. SCIM Provisioning never deactivates the organization's last active **Organization Admin**. Make another user an **Organization Admin** before that admin leaves. See [Deprovisioning](https://docs.stackone.com/secure/identity-and-access/manage-team/scim/overview#deprovisioning). With Just-in-Time Provisioning only, disable the user in StackOne as well. See [Removing access to the organization](https://docs.stackone.com/secure/identity-and-access/manage-team/overview#removing-access-to-the-organization). ## Send audit logs to your SIEM > [!NOTE] > > The Logs API is only available on certain plans. See [plans and pricing](https://www.stackone.com/pricing/). StackOne records an action log for every tool call, with the Linked Account it ran through, and a platform log for every change to StackOne itself, such as a new Linked Account. To keep them with the rest of your audit data, run a collector that pulls records from the Logs API and forwards them to your SIEM or data platform, such as Splunk or Datadog: | Logs | Endpoint | | - | - | | Action logs, one per tool call. | [List Logs](https://docs.stackone.com/platform/api-reference/logs/list-logs.md) | | Platform logs, one per change to StackOne. Changes made in the dashboard name the user who made them. | [List Platform Logs](https://docs.stackone.com/platform/api-reference/logs/list-platform-logs.md) | Each API key reads one project's logs, so give the collector a key for every project you roll out. If the project has [IP restrictions](https://docs.stackone.com/secure/ip-restrictions.md), add the collector's IP address. Sign-in attempts are in [Security logs](https://docs.stackone.com/secure/observability.md#security-logs), under **Organization > Security > Logs**. ## Examples > [accordion] Only the HR team should connect to the payroll system > > An HR team that handles payroll. > > 1. Restrict the HR connector profile that reaches payroll data. > 2. Grant the HR team's group **Connector Profile Member** on it. > 3. Only the HR team can link accounts through it. > [accordion] The support team works from one shared mailbox > > A support lead and a team of agents who all answer customers from one shared inbox. > > 1. The support lead links the mailbox once. > 2. They grant each agent **Account Member** on it. > 3. Agents send replies through the mailbox without needing its password. ## Next steps > [card] [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md) > > Give users the MCP connection for their AI platform. > [card] [Tool Policies](https://docs.stackone.com/secure/policies.md) > > Decide which tools each user's or group's agents can use. > [card] [Roles and Groups](https://docs.stackone.com/secure/identity-and-access/roles-and-groups/overview) > > How roles combine, and what admins can do with other users' linked accounts. > [card] [IP Restrictions](https://docs.stackone.com/secure/ip-restrictions.md) > > Limit which IP addresses can call a project's API. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.