SSO and SCIM

Blank supports SAML 2.0 single sign-on and SCIM provisioning. SSO is configured in Settings → Privacy & access → Single sign-on.

Owners and admins can configure these sections. Team manages workspace members and invitations; directory-managed access is changed in your identity provider. SSO and SCIM configure administrator access to Blank, not employee-device enrollment. Use Deployment for managed browsers.

How membership works

• Domain auto-join. A SAML login whose email domain matches your configured domain auto-joins your organization at the default role you set (default: viewer).
• SCIM overrides the role. If your identity provider has pushed a roster entry for that user (say, provisioned as an admin), that role wins.

To sign in, the user types their work email and clicks Sign in with SSO. Blank resolves the provider by domain and redirects to your IdP. Launching from the IdP's app tile works too.

Service-provider details

Give these to your IdP. They're shown in Settings → Privacy & access → Single sign-on.

The assertion must send the email as the NameID. The account and domain auto-join are keyed on it.

Okta

1. Okta Admin → Applications → Create App Integration → SAML 2.0.
2. Set Single sign-on URL to the ACS URL, and Audience URI to the Entity ID.
3. Set Name ID format to EmailAddress, and map the application username to the user's email.
4. Assign the app to the users and groups who should have access.
5. Copy Okta's Identity Provider metadata URL (App → Sign On).
6. In Blank, enter your email domain, paste the metadata URL, pick the default role, and Configure SSO.

Microsoft Entra ID

1. Entra admin → Enterprise applications → New application → Create your own (non-gallery).
2. Under Single sign-on → SAML, set Identifier (Entity ID) and Reply URL (ACS) from the table above.
3. Under Attributes & Claims, set the email from user.userprincipalname in both the Name ID (format: Email address) and the email-address claim. Don't leave these on user.mail. A bare *.onmicrosoft.com tenant has no mailbox, so user.mail is empty and the login is rejected. The UPN is the only email-shaped value.
4. Set Basic SAML Configuration → Relay State to your dashboard URL (https://useblank.dev/admin/). This is where an IdP-initiated login lands.
5. Assign users and groups, then copy the App Federation Metadata URL.
6. In Blank, enter the email domain (for *.onmicrosoft.com users that's <tenant>.onmicrosoft.com), paste the metadata URL, pick the default role, and Configure SSO.

Directory provisioning

Open Settings → Privacy & access → Provisioning. Copy the SCIM base URL and generate a bearer token, then add both to your identity provider. Copy the token before leaving Settings; it cannot be retrieved later. Enable provisioning once your directory is configured.

Rotating a token replaces it immediately. Update your identity provider with the new token to resume directory sync.

Update sign-in settings

Reopen Single sign-on to change the email domain, IdP metadata URL, or default role. Provide the metadata URL and select Update SSO for a configured provider. Disable pauses that provider; Enable turns it back on. Remove SSO requires confirmation.

Switching between Privacy & access sections keeps edited Single sign-on settings in memory. Leaving the page asks before discarding a draft. Wait for the update confirmation before testing sign-in; if loading fails, use Try again.

The Provisioning section shows directory configuration and provisioned accounts. Provisioning a roster entry does not itself create a login session: membership is reconciled when the person signs in. Disabling provisioning is distinct from deprovisioning a person.

Deprovisioning

Remove a user's app assignment, or push SCIM active:false, and their access is gone on their next request. Blank re-checks membership on every request, so revocation is effectively immediate.

View this page as Markdown →