Cursor Enterprise: Identity & Access Management (SSO, SCIM, roles)

Identity and access management controls who can use Cursor in your organization and what they can do: authentication, user provisioning and device-enforced policies. Cursor recommends implementing the controls in a specific order so each one builds on the last.

1. 1Set up SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. so centralized authentication works first.
2. 2Enable SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. to automate user lifecycle management.
3. 3Deploy MDM policies to enforce allowed team IDs and extensions.
4. 4Assign roles to grant admin access to the right people.

SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. lets users authenticate to Cursor with your existing identity provider instead of separate Cursor passwords. Cursor supports SAMLAn enterprise standard that powers single sign-on. 2.0 with providers like Okta, Azure AD, Google Workspace and OneLogin. When you enable SSO you can require it for all team members, which prevents password-based authentication entirely.

SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. 2.0 provisioning automatically manages team members and directory groups through your identity provider. It is available on Enterprise plans with SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. enabled. Without SCIM you add and remove users in Cursor by hand; with it, the identity provider drives membership.

• New employees get Cursor access automatically when added to the right group.
• Departing employees lose access when removed from your IdP.
• Group membership changes propagate automatically.

Mobile Device Management (MDM) systems enforce policies on user devices. Cursor supports MDM-based policies on macOS and Intune / Group Policy on Windows. An MDM policy overrides the equivalent user-configured Cursor setting on each device.

The most important MDM policy prevents users from logging into personal Cursor accounts on corporate devices. When you set an allowed team ID policy, Cursor only permits authentication to those specific team IDs. The cursorAuth.allowedTeamId setting accepts a comma-separated list, so "1,3,7" allows users from those three team IDs. To manage it centrally, configure the AllowedTeamId policy through your MDM, which overrides the local setting.

• A user who tries to log in with a team ID not on the list is forcefully logged out immediately.
• An error message is displayed.
• Further authentication attempts are prevented until a valid team ID is used.