Sign-in and provisioning

Administration, Sign-in and provisioning shows how people sign in and how your directory keeps Spend up to date.

Single sign-on

People sign in with OpenID Connect or SAML 2.0 through Microsoft Entra ID, Okta, Ping, ADFS or Google Workspace. Single sign-on is set up once per organization with your identity team; the technical steps are in Single sign-on. You can require multi-factor authentication, and sign-ins without it are refused and recorded.

Directory provisioning (SCIM)

1. Choose Issue a token. It is shown once; copy it.
2. In your directory’s provisioning settings (Entra ID, Okta or another SCIM 2.0 directory), enter the tenant URL shown on the page and the token.
3. Start provisioning. People and groups appear in Spend.

A person the directory sends is linked to an existing Spend user with the same email, or created with no roles.

Map groups to roles

Map each directory group to the Spend roles it grants. Once a map is saved, a directory-managed person’s roles are exactly what their groups grant:

• Removing a group’s roles, or the last mapping, takes those roles away.
• Renaming a group in the directory re-decides everyone in it.
• A change that would combine conflicting duties is refused and logged, and the person keeps the roles they had. The page counts refused changes.

Removing a person in the directory deactivates them in Spend.