1 min lesson
Admin control plane
Tell someone how to act on this idea: "Start with this check: Domain and IdP metadata are correct."
Step 1 of 3
The job: you can order SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. before SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., enforce login safely, and name the first check when login or provisioning fails. Start with this check: Domain and IdP metadata are correct. Keep it small enough to check the result yourself instead of taking the summary on trust.
Learn more
Full explanation
Admin control plane
Enterprise identity — set up SSO, then SCIM, then enforce
Admin control plane
SayA company needs governed login and automatic provisioning for its team. Cursor recommends a fixed order: SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. first, then SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., and I enforce last.
DoStart with SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition.. Verify the domain and connect the identity provider (Cursor supports SAML 2.0), so people sign in through the IdP you already run instead of separate Cursor passwords.
SeeDomain verified and IdP metadata correct: SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. authentication works before anything is enforced.
DoEnable SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. next. On Enterprise with SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. on, SCIM 2.0 auto-provisions team members and directory groups from the IdP: added to the right group grants access, removed from the IdP deprovisions.
SeeProvisioning and deprovisioning now flow from the directory, not from hand-editing the team. This is where people confuse SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. authentication with SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. provisioning; they are two different controls.
SayOnly after I have tested access recovery do I require SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. for all members, which turns off password sign-in entirely.
DoTest enforcement with a non-admin account, not just my admin login.
SeeThe non-admin is forced through the IdP and cannot fall back to a password. Enforce before recovery is tested and you can lock people out.
DoIf several teams are linked, set SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. at the org level through Organizations rather than per team.
SeeOne org-level identity model covers the linked teams, and team-level SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. stays available for a team with its own requirement.
Learn more
Optional practice
Practice: Admin control plane
QYou've applied it. What actually proves the work is done, not just a plausible answer?