Before you start
You need:- an active OpenWhispr Enterprise workspace with owner or admin access
- a verified company domain connected to SAML or OIDC under Security > Single sign-on
- administrator access to your identity provider
- enough workspace seats for the people you assign
Keep Allow just-in-time fallback on during your pilot. Existing employees can continue to join through verified company SSO even if they have not been pushed through SCIM yet.
Connect your directory
1
Enable directory sync
In the OpenWhispr admin portal, open Security > Directory sync, explicitly select the verified SSO provider for this directory, and select Enable directory sync. Pause directory sync before moving the connection to another verified provider.
2
Create a provisioning token
Select Create token, then copy both the SCIM base URL and token. The full token is shown once and expires after 90 days by default. Store it in your identity provider, not in a shared document or ticket.
3
Configure your identity provider
Use the SCIM base URL as the tenant or connector URL and the token as a bearer token. Then configure the attributes and actions below.
- Microsoft Entra ID
- Okta
- Another SCIM provider
In the enterprise application you use for OpenWhispr, open Provisioning, choose automatic provisioning, and enter the OpenWhispr tenant URL and secret token.Use Sync only assigned users and groups for a controlled rollout. Test the connection, assign a pilot group, then start provisioning.
4
Map user attributes
Send these standard SCIM attributes:
Group pushes use
displayName, externalId, and members[].value.5
Verify the pilot
Return to Security > Directory sync. Confirm that the assigned people and groups appear, then have a pilot employee choose company SSO in the desktop app.Their first SSO session links the pre-provisioned directory record to their OpenWhispr identity. No invitation, API key, AWS profile, or Azure key is required.
6
Enforce the final state
After every intended employee is visible in the directory table, turn off Allow just-in-time fallback. Then enable Require SSO under Security > Single sign-on.Turning off the fallback removes every non-owner workspace member who does not have an active linked directory record, including their workspace-team memberships. The confirmation shows the exact number first. Verify the directory table before continuing.From that point, only active people assigned by your directory can enter the workspace, and password or social sign-in cannot be used for the verified domain.Enabling it also ends sessions that did not come through your IdP, so an admin who signed in with a password is returned to sign-in to re-authenticate. The workspace owner keeps admin-console access without an SSO session, so a misconfigured IdP can always be undone.
What each directory change does
SCIM-managed teams are read-only in the OpenWhispr admin portal. Change their names and membership in your identity provider so the two systems do not drift.
Directory changes take effect when the identity provider sends the next successful SCIM request. Scheduled sync timing and retries are controlled by that provider, so a change made in Entra or Okta may not appear immediately. For urgent offboarding, revoke the employee’s IdP session, run an on-demand provisioning cycle, and verify that the person is inactive in the OpenWhispr directory table. Deactivation removes cloud workspace and team access when OpenWhispr receives it; it does not remotely erase notes already stored on an employee device.
Supported SCIM operations
The connection exposes/Users, /Groups, /ServiceProviderConfig, /Schemas, and /ResourceTypes below the base URL shown in the admin portal.
Requests are limited to 600 per minute per directory connection. A
429 response includes Retry-After.