> ## Documentation Index
> Fetch the complete documentation index at: https://learn.biq.li/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO and SCIM overview

> Understand enterprise authentication and directory provisioning in Biqli.

SAML SSO lets members authenticate through your organization's identity provider. Just-in-time provisioning can create an eligible Biqli membership when a user signs in successfully for the first time.

SCIM directory sync manages user lifecycle and supported assignments from the identity provider. It is useful when access must follow a central directory rather than manual invitations.

These features solve different parts of identity management. SAML handles authentication, while SCIM handles provisioning. Availability depends on the workspace plan. Use the provider-specific guide for exact setup values.

## Compare the features

| Feature                   | Purpose                                                              |
| ------------------------- | -------------------------------------------------------------------- |
| SAML SSO                  | Authenticates members through the organization's identity provider   |
| Just-in-time provisioning | Creates eligible membership during a successful first SAML sign-in   |
| SCIM                      | Creates, updates, and deactivates supported directory-managed access |

## Plan deployment

1. Keep an authorized recovery administrator available.
2. Configure SAML with the exact entity ID, sign-on URL, certificate, and
   attributes shown by Biqli.
3. Test with a small assigned group before enforcing it broadly.
4. Add SCIM only after authentication works.
5. Verify create, update, assignment, and deactivation behavior with test users.

SAML and SCIM configuration contains sensitive tenant identifiers, certificates,
and tokens. Store them in the identity provider and Biqli settings designed for
that purpose.

Use the Azure AD, Okta, Google Workspace, and SCIM-specific guides for the
provider workflow supported by your organization.

## Frequently asked questions

### Do I need SCIM to use SAML?

No. SAML handles authentication. SCIM is added when directory-managed
provisioning and deactivation are required.

### Should I enforce SSO before testing?

No. Test assigned users and preserve an administrative recovery path first.

### Can SCIM replace workspace ownership?

No. Workspace ownership safeguards remain separate.