Onboarding a company through your identity provider

Your company already keeps one authoritative list of people, and it is not in Sencai. Somebody joins, changes team, or leaves in Microsoft Entra ID or Google Workspace, and you want that to be the only place the change has to happen. A new hire should get access because they were added to a group, a leaver should lose it because they were disabled, and somebody should notice when an admin account has its second factor switched off.

Sencai supports this through three separate mechanisms that are easy to confuse: a directory connection (authentication and directory data flowing in), SCIM provisioning (your identity provider driving membership), and SSO enforcement (password sign-in switched off for your members). They are configured independently, and you do not need all three.

What Sencai does not do is take permissions from your directory. Everyone provisioned through SCIM arrives with the Member role, and there is no group or attribute mapping to any other role. Who is an Admin stays a decision you make inside Sencai. The order below matters, because two of these steps can lock people out - including you - if you do them in the wrong sequence.

What this looks like in Sencai

1. Check the plan before you plan anything

Connecting your own tenant, SCIM provisioning, and SSO enforcement all start at the Business tier. An Owner or Admin can check and change this from Settings → Subscription (/gravity/settings/subscription); Organization plans covers what each tier includes.

Worth knowing before you buy anything: the Continue with Google and Continue with Microsoft buttons on the sign-in page already work for anyone, on any tier, with no configuration. What the Business tier adds is your own tenant connected for directory data, provisioning driven from your side, and the ability to make your identity provider the only way in.

2. Connect the directory

This is the step everything else depends on, and the two providers work nothing alike. Single sign-on walks both.

Microsoft Entra ID is an admin consent flow at Settings → Integrations → MS365 Integration (/gravity/settings/integrations/ms365): you enter your tenant ID, a Global Administrator approves three read-only Microsoft Graph permissions, and license and audit data start flowing. Google Workspace is Domain-Wide Delegation at Settings → Integrations → Google Workspace Sync (/gravity/settings/integrations/google-workspace): you create a service account in Google Cloud, authorize its Client ID for four read-only scopes in your Google Admin Console, then upload the key and name a real administrator to impersonate. Finish with Test Sync, which reports the number of users and groups it found.

Neither connection changes how anybody signs in. It is a data connection.

3. Turn on provisioning

Settings → Integrations → SCIM Provisioning (/gravity/settings/integrations/scim) gives you a base URL and a bearer token to paste into your identity provider’s provisioning connector. SCIM provisioning has the per-provider detail.

SCIM is where “created and removed automatically” actually happens, and it is independent of step 2 and step 4 - you can run provisioning without ever enforcing SSO, and the page carries setup instructions for Okta as well as Entra ID and Google Workspace. Generate the token, copy it out of the dialog immediately (it is shown once), and put a reminder in your calendar: tokens expire 90 days after creation.

4. Decide about enforcement, carefully

Settings → Integrations → SSO Enforcement (/gravity/settings/integrations/sso-enforcement) is what stops your members from signing in with a password. It is checked on the server, so it cannot be worked around from a browser.

5. Check what actually landed

Workspace → Directory (/gravity/workspace/directory) is the synced, read-only view of the users and groups Sencai pulled in, with Users/Groups tabs and Active / Suspended / Admins filters. Workspace directory explains what syncs from where and how often - the short version is that the Google Workspace sync runs hourly, and Microsoft 365 license counts refresh nightly.

Treat these screens as a mirror, not a control panel. There is no “Add user” here; membership flows the other way.

6. Give the security events an owner

Workspace → Watchdog (/gravity/workspace/watchdog) is the payoff for having connected the directory at all: MFA being disabled, admin privileges granted, account suspensions, password resets, OAuth app authorizations and bulk deletes, from both providers, in one feed with a severity and a source badge. Identity watchdog covers the taxonomy and the per-provider gaps.

Nothing here escalates on its own. Somebody has to open the feed, expand a row, and mark it resolved or a false positive - and neither of those is reversible from that screen. Decide who that person is while you are still setting this up, not the first time something fires. If you connected Google Workspace, Workspace → Security Posture (/gravity/workspace/security-posture) adds a 2-step-verification score weighted toward admin accounts, which makes a reasonable recurring review item.

What will surprise you

SCIM does not require SSO, and SSO does not give you SCIM. They are separate setup steps with separate configuration screens. Plenty of organizations only want provisioning - automatic joiners and leavers, but people still choose how they sign in - and that is a supported combination. Do not enforce SSO just because you wanted automatic offboarding.

Enforcement can strand the person who configured it. The Microsoft path is self-contained: complete admin consent and you have a working sign-in path. The Google Workspace path is not - your verified domain has to be registered separately, and that is not a self-service field today. If the enforcement screen still reports Google Workspace as “not configured” after you finished the Directory Sync wizard, stop and ask your account team rather than toggling anything.

Deprovisioning disables, it does not delete. When your provider sets a user inactive, that person can no longer sign in. Their membership record and everything they created - instances, runbooks - stay exactly where they were, visible to an Owner or Admin on the Members tab. That is usually what you want for an offboarding, but it is not a data-removal mechanism.

Everyone arrives as a Member. Change roles afterward on the organization’s Members tab. Roles & permissions is worth reading before you do, mainly because Auditor sits below Member in the hierarchy despite what it sounds like.

A pending invitation is not membership. Someone you invited but who has not accepted yet can still complete that invitation with a password, even while enforcement is on, because enforcement only applies to actual members. Clear out old pending invitations before you switch enforcement on.

Microsoft’s consent does not cover groups, and sign-in logs cost extra. The three permissions granted at consent do not include reading Microsoft 365 group membership, so group data does not sync from Entra. Separately, reading Entra sign-in activity needs a paid Entra ID P1 or P2 license on your tenant - without it, login-anomaly events never appear in the watchdog, while directory audit events still do. Neither is something Sencai can unlock for you.

The Workspace screens are lopsided toward Google. Org Units, license assignment, Cloud Identity Premium, and the security posture score are Google Workspace only. Entra contributes license counts and audit events, and its directory sync has no self-service trigger in the app. And two of the Google screens write for real: moving a member between org units and assigning or revoking a license both change your actual Google Workspace, not just a record in Sencai.

Watchdog events are not Sencai’s audit log. They come from your provider’s own audit APIs and describe things that happened in your directory. Actions taken inside Sencai are a separate trail - see Audit log.

What’s next

Organization plans - confirm you are on Business or Enterprise before starting, since every step here is gated on it
Single sign-on - the Entra consent flow, the Google Domain-Wide Delegation flow, and how to enforce without locking yourself out
SCIM provisioning - the endpoint, the 90-day token, and exactly what a deprovision does
Identity watchdog - the event feed somebody needs to own
Roles & permissions - because SCIM only ever assigns Member, and you decide the rest