---
title: "Single sign-on and directory sync"
description: "Set up SAML or OpenID Connect single sign-on and SCIM directory sync through the identity provider's hosted setup portal, test the connection, and see what happens when someone is removed from the directory."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on and directory sync

Setup happens on your identity provider's hosted portal, not in Overlane. Overlane issues a short-lived link, shows the state of the connection and tests it. It never sees your identity provider's admin credentials, and no provider-specific type appears in the API: a connection is `saml` or `oidc`, a directory is `dsync`.

## Set up single sign-on

```sh
overlane enterprise sso link
overlane enterprise status
```

`sso link` prints a link that expires in minutes; open it yourself or hand it to whoever administers the identity provider. The link is the credential, so it is shown once and never written to a log. Issuing a link is recorded in the [audit log](/enterprise/audit-and-siem/) with who asked.

The same step is the **Set up single sign-on** button in Enterprise settings (`overlane.app/<workspace>/settings/enterprise/`), which then shows the connection as Not set up, Setup in progress, Active or Failed, with the protocol, the domains and when it was last tested. **Test connection** checks the connection end to end and records the result.

## Set up the directory

```sh
overlane enterprise sso link --intent dsync
overlane enterprise sso sync
```

Once the directory is connected, a sync reads it and applies it:

- a person marked inactive in the directory loses access: their agent tokens are revoked, their sessions end, the runs they started are ended with a record and the task leases they hold are released;
- a person's groups set their role, within the cap in [Mapping groups to roles](/enterprise/group-roles/);
- the owner role is never changed from the directory.

## Removal takes effect within five minutes

A sync runs every five minutes on its own, and `enterprise sso sync` runs one now. Each removal is applied once, however many times the directory reports it, and the report states how many seconds it took against the five-minute deadline. A removal that was applied later than that is reported as such rather than hidden.

Removing a person through the directory follows exactly the same path as removing a member in [teams and roles](/teams-and-roles/), so the same things are released.

## Plans

Single sign-on and directory sync are included from the Business plan up.

Source: https://docs.overlane.app/enterprise/sso-and-scim/index.mdx