> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antsfield.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Configure SAML SSO and SCIM provisioning for enterprise teams.

Workspace **owners** manage security under **Settings → Security**. These features are designed for organizations that centralize authentication in an identity provider (IdP).

## SAML Single Sign-On (SSO)

SAML SSO lets your team sign in to Retrac with your corporate identity provider — Okta, Google Workspace, Azure AD, and others supported in the setup wizard.

### Set up SAML

1. Go to **Settings → Security**.
2. Under **SAML Single Sign-On**, click to configure.
3. Choose your identity provider from the list.
4. Follow the in-app steps to exchange metadata and ACS URLs with your IdP.
5. Test login with a user assigned to the Retrac application in your IdP.

Once configured, team members can use **Sign in with SAML** from the login page (or enforce SSO-only access per your IdP policy).

### Remove SAML

Owners can disconnect SAML from the Security page menu. Existing password-based users retain their accounts; coordinate with your IT team before removing production SSO.

<Note>
  SAML is included on **Enterprise** plans. Lower plans may see upgrade prompts when accessing SSO configuration.
</Note>

## SCIM provisioning

SCIM automatically creates, updates, and deprovisions users in Retrac based on your IdP directory — reducing manual invite management for large teams.

### Set up SCIM

1. Go to **Settings → Security**.
2. Under **SCIM**, generate or configure your SCIM endpoint and bearer token.
3. In your IdP, enable SCIM provisioning for Retrac using the provided URL and credentials.
4. Map attributes (email, name) per IdP documentation.
5. Assign users or groups in the IdP to provision access.

### Remove SCIM

Disconnect SCIM from the Security page when rotating credentials or decommissioning automated provisioning. Review active members afterward.

## Best practices

* **Test in a staging IdP app** before enforcing SSO on production users
* **Keep at least one break-glass owner account** with a non-SSO recovery path if your IdP is unavailable
* **Pair SCIM with location access** — provision users into Retrac, then let owners assign location permissions in **Settings → Members**
* **Rotate SCIM tokens** if credentials may have been exposed

## Personal account security

SAML and SCIM are workspace-level. For your own password, two-factor settings, and connected accounts, see [Account settings](/dashboard/account/introduction).