Single sign-on & SCIM

Let your team sign in through your identity provider with SAML 2.0, and keep members, roles, and groups in sync with SCIM. Step-by-step setup for Auth0 and Microsoft Entra ID.

Single sign-on (SSO) lets members sign in to StatusPal Next through your company's identity provider over SAML 2.0 instead of a separate password, and SCIM lets that same identity provider create, update, and remove members for you.

SSO vs. SCIM. SSO controls how members sign in. SCIM controls who exists in your organization and which role or group they hold, whether or not they ever sign in. You set up SSO first; SCIM rides on top of it and matches members by email to the identity SSO establishes.

Both apply to your organization members: the admin dashboard and any status page restricted to authenticated users. They are separate from the Google and GitHub options on the same Security page, described in Sign-in methods and account linking, and from how your status page subscribers receive notifications.

Configure a SAML provider

Before you begin:

• You need an organization admin account. The Security settings are admin-only.

• SSO and SCIM require a paid plan. On the Free plan the toggle is locked with a Paid plan only badge.

• Your identity provider must support SAML 2.0, and outbound SCIM 2.0 if you also want provisioning.

• You can configure one SSO provider per organization.

Turn on SSO and add your provider

1. In the admin dashboard, go to Settings → Security.

2. Under Authentication methods, turn on SSO & SCIM, then click Save settings. Until a provider is active, the card shows a No active provider badge.

3. The SSO providers section appears below. Click New SSO Provider to open the setup form.

The form asks for a Display name, shown in the admin UI and on member sign-in buttons, and your identity provider's metadata, pasted as a Metadata URL or uploaded as a file. Advanced options hides settings some providers need, such as Sign authentication requests. Leave Enabled ticked and click Create Identity provider.

StatusPal Next saves the provider and shows Step 2 - Share these settings with your identity provider, with the ACS URL, the SP Entity ID, and a Download metadata button. Your identity provider needs these to trust StatusPal Next. The Auth0 and Microsoft Entra ID sections below walk through both sides for each provider.

Share the SSO access URL

1. Back on Settings → Security, confirm your provider shows an Active badge in the SSO providers table.

2. Copy the SSO access URL shown at the top of the section.

3. Share that link with your team. When a member opens it, they are taken straight to your identity provider to sign in and then returned to StatusPal Next. Members don't reach SSO from the general sign-in screen.

Badge	Meaning
Active	Registered and ready. Members can sign in.
Pending	Still being registered with the authentication service.
Disabled	Turned off and hidden from sign-in pages until re-enabled.
Error	Registration failed. Check your metadata URL and save again.

From the same table you can Enable or Disable a provider without deleting it, Edit its display name, metadata, or advanced options, or Delete it permanently.

At least one sign-in method must stay available to every member. StatusPal Next won't let you turn off SSO, or any other method, if doing so would leave someone with no way to sign in. Set up an alternative for those members first.

Connect SCIM provisioning

Once a provider is Active, scroll to the SCIM provisioning section on the same page.

1. Read the Before you connect warning: once connected, members of the statuspal-next-admins group keep the Admin role, while other current admins are demoted on the next sync except the organization's last admin, whose Admin role is preserved. Create that group first.

2. Click Connect SCIM. StatusPal Next generates a bearer token and shows it once. Copy it now; if you lose it, click Rotate token for a new one.

3. Copy the SCIM endpoint URL shown below the token. It ends in /scim/v2.

You will paste both into your identity provider in the provider sections below.

Standard role groups. Create these three groups in your identity provider, with these exact names, to drive StatusPal Next roles. The section lists them with copy buttons.

Identity provider group name	StatusPal Next role
statuspal-next-admins	Admin
statuspal-next-members	Member
statuspal-next-status-viewers	Status viewer

The mapping is wholesale: everyone in a group gets that role, and anyone who holds the role but isn't in the group loses it on the next sync. Once a role is driven by SCIM you can no longer change it by hand in StatusPal Next. A provisioned member who is in none of these groups gets the default role: Status viewer if your organization has the Status Pages module enabled, otherwise Member.

Team groups. You can also drive a team group's membership from an identity provider group. In Settings → Team Members → Groups, open or create a group and set its SCIM group name to the exact name of the matching group in your identity provider, for example Product-Team. From then on that group's membership is set by your identity provider and can't be edited by hand. The three role group names above are reserved and can't be used here. See Invite and manage members.

What locks. Members whose role or group membership comes from SCIM show a Managed via SCIM badge in the Team Members list, and the matching control is disabled with a tooltip explaining why.

Every SCIM-driven change is recorded in Settings → Audit logs: a role changed via SCIM, a member added to or removed from a group, and a pushed group that matched no role or group, so a mistyped group name is visible instead of failing silently. See Audit logs.

Provisioned members appear in Team Members as pending until they first sign in through SSO. Deprovisioning a member in your identity provider removes them from your organization. From the SCIM provisioning section you can Rotate token, which invalidates the previous token immediately, or Disconnect. Disconnecting removes nobody; it hands control of the affected roles and groups back to you, starting from whoever currently holds them.

Not every identity provider pushes groups. Role and team group sync rely on SCIM group updates. Microsoft Entra ID sends them. Auth0's outbound SCIM sends users only: it can provision and deprovision members, who receive the default role, but it can't drive roles or groups.

Auth0

Single sign-on

1. In a separate tab, open the Auth0 Dashboard and sign in.

2. Go to Applications → Applications and click Create Application.

3. Enter a name such as StatusPal Next, select Regular Web Application, and click Create.

4. Open the Addons tab and enable SAML2 Web App. The SAML2 configuration dialog opens.

5. In that dialog, open the Usage tab. Next to Identity Provider Metadata, copy the URL behind the Download link (right-click, then Copy link address). Leave the dialog open.

1. Back in the StatusPal Next New SSO Provider form, enter Auth0 as the Display name, paste the copied link under Metadata URL, and click Create Identity provider.

2. On the Step 2 card, copy the ACS URL.

3. In the Auth0 SAML2 dialog, open the Settings tab, paste the ACS URL into Application Callback URL, scroll to the bottom, and click Enable.

Auth0 is now connected. Continue with Share the SSO access URL.

SCIM provisioning

Auth0 provisions and deprovisions users through Event Streams and an Auth0 Action running Auth0's outbound SCIM template. It reacts to users being created, updated, or deleted in your Auth0 directory and sends the matching SCIM request to StatusPal Next.

1. In the Auth0 Dashboard, go to Event Streams, create a stream, and choose Auth0 Actions as the destination. Name it, for example StatusPal Next SCIM.

2. Under Select Events, tick user.created, user.updated, and user.deleted. Leave the group events unchecked.

3. Auth0 creates a linked Action. In the Action editor, open the Secrets panel and add SCIM_BASE_URL, set to your SCIM endpoint URL, and SCIM_BEARER_TOKEN, set to your bearer token.

4. Copy Auth0's outbound SCIM Action template into the Action editor, then save and deploy. For background, see Auth0's guide Synchronize user changes with Outbound SCIM using Event Streams.

5. Event Streams only react to new events, so run a one-time bulk sync of your existing Auth0 users into StatusPal Next before enabling the stream.

6. Enable the stream.

New Auth0 users now appear under Team Members as pending members with the default role, and deleting a user in Auth0 removes them. Because Auth0 sends only user events, roles and team groups stay managed by hand in StatusPal Next.

Microsoft Entra ID

Single sign-on

1. In a separate tab, open the Azure Portal, sign in, and open Microsoft Entra ID.

2. Click Add → Enterprise application, then Create your own application.

3. Enter a name such as StatusPal Next, keep Integrate any other application you don't find in the gallery (Non-gallery) selected, and click Create.

4. Assign yourself so you can test sign-in: Assign users and groups → Add user/group, pick your account, then Assign. You can add the rest of your team later.

5. In the left menu, click Single sign-on and choose SAML.

6. In SAML Certificates, copy the App Federation Metadata Url.

1. Back in the StatusPal Next New SSO Provider form, enter Microsoft Entra ID as the Display name and paste the URL under Metadata URL. Expand Advanced options and turn on Sign authentication requests: Entra ID verifies signed requests with the certificate in the metadata you upload in the next step. Click Create Identity provider.

2. On the Step 2 card, click Download metadata to save StatusPal Next's service-provider metadata file.

1. On the Entra ID SAML-based Sign-on page, click Upload metadata file, select the file you just downloaded, click Add, then Save. This fills in the Identifier (Entity ID) and Reply URL (ACS URL) for you.

Entra ID is now connected. Continue with Share the SSO access URL.

SCIM provisioning

Entra ID provisions users and groups, so it drives the whole feature: provisioning, role sync, team group sync, and deprovisioning.

1. In Microsoft Entra ID → Enterprise applications, open the application you created for SSO.

2. Select Provisioning and set Provisioning Mode to Automatic.

3. Under Admin Credentials, paste your SCIM endpoint URL into Tenant URL and your bearer token into Secret Token.

4. Click Test Connection. A success confirms the URL and token are right. Save.

5. Create the groups that drive roles and team groups, and assign them and your users to the application under Users and groups. Entra ID only provisions what is assigned:

   • For roles, groups named exactly statuspal-next-admins, statuspal-next-members, and statuspal-next-status-viewers.

   • For a team group, a group whose name matches the SCIM group name you set in StatusPal Next.

6. Select Start provisioning.

Entra ID syncs on a schedule: the first cycle runs shortly after you start, and later cycles run about every 40 minutes. To test a single user right away, use Provision on-demand, and watch Provisioning logs to confirm each user and group was sent.