---
title: "Enterprise access"
description: "Configure OIDC SSO and SCIM 2.0 role provisioning."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.aroundtime.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise access

Aroundtime supports organization-linked single sign-on and SCIM 2.0 provisioning for B2B workspaces. Only organization owners and admins can manage these connections.

## OIDC single sign-on

Open **SSO & SCIM**, then provide:

- A unique provider ID, such as `acme-okta`.
- The identity provider issuer URL.
- The organization's email domain.
- The OAuth client ID and client secret.

Aroundtime reads the provider's OIDC discovery document and registers the connection with the active organization.

Users may start SSO from the sign-in page by entering their work email. Aroundtime resolves the provider from the email domain and provisions organization membership when authentication succeeds.

## SSO role provisioning

Aroundtime maps upstream role attributes as follows:

- Values containing `admin` or `owner` become Aroundtime Admin.
- Other values become Member.

Automatic provisioning is idempotent. A returning SSO user keeps a single organization membership.

## SCIM 2.0

Create a SCIM connection from **SSO & SCIM**. Aroundtime displays the base URL and bearer token once.

```text
Base URL: https://aroundtime.co/api/scim/v2/{connection-id}
Authorization: Bearer {token}
```

Supported User operations include list, filter by `userName`, create, retrieve, replace, patch, and delete. Role values are mapped to Admin or Member.

> **Store the bearer token securely**
>
> Treat the SCIM token as a production credential. Copy it directly into the identity provider and rotate or revoke the connection if it is exposed.

## Service provider discovery

Each connection exposes standard SCIM endpoints:

- `/ServiceProviderConfig`
- `/ResourceTypes`
- `/Schemas`
- `/Users`

Source: https://docs.aroundtime.co/enterprise/index.mdx