Skip to lesson
Exit
Cursor Product & Architecture1 / 2

2 min lesson

Auth, SSO and admin

Consider this situation: "An enterprise admin reports: 'Half our developers can use Chat and Agent, the other half just get errors. Same version, same company.' What's your hypothesis order?" Start with the decision, then the evidence.

Step 1 of 2

Auth, SSO and admin

Enterprise auth is its own category. SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. sits between the user and the product, so a failed login is frequently an identity-provider configuration issue, not a Cursor bug. Admin and team management (who has a seat, what policy applies, which data controls are enabled) explains a lot of "why can't I do X" tickets.

  • SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition.. Login loops or "access denied" often trace to the IdP config: wrong assertion mapping, an unprovisioned user or a domain not verified. Confirm with the admin before assuming a defect.
  • Admin / team management. Seat assignment, role/policy and enabled data controls govern what a user can do. Many capability complaints are policy, working as configured.
  • Privacy / data controls. Enterprise policy can disable indexing of certain content or restrict what's sent. Verify the policy before treating restricted behavior as broken.
Legacy privacy mode blocks cloud agents

A specific, non-obvious gotcha that generates real tickets: cloud agents and automations respect the same privacy mode as the user's account (code not used for training), but they do not work with legacy privacy mode.

The reason is mechanical: the cloud VM must store the codebase for the duration of the agent run, which legacy privacy mode forbids. A user on legacy privacy mode who reports "cloud agents won't start" isn't hitting a bug. They need to switch off legacy privacy mode. Confirm which mode is set before escalating.