Identity Provider Sync

Drive Seemore roles and team membership from the groups in your identity provider, so access follows the directory you already maintain.

Overview

If your workspace signs in through Okta with SCIM provisioning, you can stop maintaining roles and team membership by hand. Push your Okta groups to Seemore, then map each group to:

• the roles its members should hold, and

• the teams its members should belong to.

From then on, a change in Okta is the only change you make. Adding someone to the Analytics group gives them the Analytics role and team on their next sign-in; removing them takes both away.

Required role to configure: Admin or higher.

Granting or removing the Owner role on a group is reserved for Owners. Admins can assign every other role.

Group sync is available for Okta connections with SCIM provisioning enabled. Automated provisioning is not available for Microsoft Entra ID — see Setup Microsoft Entra ID SSO.

---

Prerequisites

1. An Okta connection configured in Seemore, with Enable SCIM provisioning turned on and a SCIM token created. See Setup Okta SSO.

2. Push Groups enabled in Okta for the Seemore application, listing the groups you want to map. Only the groups you explicitly push appear in Seemore.

3. For team mapping, the teams you intend to map must already exist in Seemore.

---

Where to Find the Mappings

1. Go to Settings → Preferences → Authentication.

2. Hover the Okta card and click Edit.

3. Continue to the SCIM step. Below the SCIM endpoint and tokens you will find Group → role assignment and Group → team assignment.

Both sections list the groups Okta has pushed. If a group is missing, confirm it is selected under Push Groups in Okta, then reopen the page.

---

Syncing Roles

Assign one or more Seemore roles to each group, then click Save roles.

Each pushed group is mapped to the Seemore roles its members receive.

How role resolution works

• A user receives the combined roles of every group they belong to. Someone in both Analytics (Editor) and Platform Admins (Admin) is treated as an Admin, since roles are hierarchical.

• Roles apply on the user's next sign-in. Assign them before the person signs in again, or ask them to sign out and back in.

• Your groups are authoritative. On each sign-in a user's roles are reconciled to match what their groups grant, so removing a role from a group — or removing the user from the group — revokes it.

• Groups you leave with no roles grant none. A group left untouched keeps whatever it had; saving only changes the groups you edited.

---

Syncing Teams

Assign one or more Seemore teams to each group, then click Save teams.

Each pushed group is mapped to the Seemore teams its members join.

How team membership is applied

• Members join and leave the mapped teams as their group membership changes, applied on their next sign-in.

• Only mapped teams are managed. A team that no group points at is left completely alone, so membership you added by invitation or on the Teams page is never overwritten.

• Within the mapped teams, your directory wins: if a user is no longer in the group that granted a team, they are removed from that team on their next sign-in.

• Because teams carry asset groups, mapping a group to a team is what actually grants data access. Set the team's access up first, then map the group to it.

• Sign-ins that carry no group information — a password or Google sign-in, for example — leave team membership untouched.

Saving either mapping also switches the connection to add users to your workspace automatically on first sign-in, so someone who exists only in a mapped group does not need a separate invitation.

---

A Worked Example

Suppose you want your analytics engineers to be Editors with access to the production warehouses.

1. In Seemore, create the asset group Production warehouses covering those accounts.

2. Create the team Analytics Engineering and grant it that asset group.

3. In Okta, push the Analytics group to the Seemore application.

4. In Group → role assignment, map Analytics → Editor and save.

5. In Group → team assignment, map Analytics → Analytics Engineering and save.

From now on, adding someone to the Okta Analytics group is all it takes. On their next sign-in they become an Editor with access to the production warehouses; removing them from the group reverses both.

---

Troubleshooting

Symptom	Cause	Resolution
Group is missing from either section	The group has not been pushed from Okta	Add it under Push Groups in Okta, then reopen the Authentication page
Neither section is shown	SCIM is not enabled and saved on the connection	Turn on Enable SCIM provisioning, save, then reopen the connection
A role or team change has not taken effect	The user has not signed in since the change	Changes apply on the next sign-in — ask them to sign out and back in
The team list is empty	No teams exist yet	Create the team first under Settings → Access control → Teams
Cannot assign the Owner role	Only an Owner may grant or remove the Owner role	Ask an Owner to make the change
A member kept a team you removed the group for	Another mapping, an invitation, or a manual edit also grants that team	Check the team's membership on the Teams page

---

Notes & Best Practices

• Keep one group per role level. Groups that mean two things at once are hard to audit later.

• Map access, not people. Once the mapping is in place, resist editing membership in Seemore for mapped teams — the next sign-in will reconcile it back.

• Change roles before the sign-in, since a role a user already holds in their session stays until they sign in again.

• Review the mapping after renaming or deleting a Seemore team, as deleting a team also removes it from every group mapping.