Skip to main content

SSO and SCIM provisioning

Single sign-on (SSO) — Business and Enterprise plans​

SSO lets your recruiters sign in to RecrutAuto with your company directory (Google Workspace, Microsoft Entra ID, Okta… — any OIDC/SAML provider).

Configuration, from Organization > Security:

  1. Declare your identity provider (discovery URL, client credentials)
  2. Verify your email domain: accounts from this domain will be attached to your organization
  3. Test the sign-in with a pilot account before enabling it for everyone
SSO account validation

A user who signs in for the first time via SSO gets a pending account (PendingUser): they have access to nothing until an OrgAdmin has validated them — and validation consumes a seat. You thus keep control of billed seats even with SSO open to the entire domain.

SCIM provisioning — Enterprise plan​

SCIM automates the account lifecycle from your directory:

  • automatic account creation when an employee arrives;
  • automatic deactivation when they leave (the seat is freed);
  • attribute synchronization (name, email).

The SCIM token is generated from Organization > Security. The expected endpoint and format are detailed in the API documentation.

tip

SSO without SCIM (Business plan): accounts are created as people first sign in and still need to be validated manually. SCIM (Enterprise) removes that step while keeping the seat limit.