- Available on: Business and Enterprise plans (SCIM provisioning is Enterprise only)
- Access: Workspace admins and owners
- Location: Settings → Members & access → Identity
What’s on the Identity tab
| Section | What it does | Details |
|---|---|---|
| Verified domains | Prove ownership of your company’s email domains. Required for everything below. | Verify a domain for your workspace |
| SSO providers | Connect one SAML or OIDC identity provider, such as Okta, Auth0, or Microsoft Entra ID. | Set up workspace single sign-on (SSO) |
| Enforce SSO | Require all workspace members to sign in through your identity provider, and set the session duration. | Set up workspace single sign-on (SSO) |
| User provisioning | Control how users with verified-domain emails join the workspace automatically. | This page, below |
| SCIM provisioning | Manage user lifecycle centrally from your identity provider (Enterprise plan). | Set up SCIM user provisioning |
User provisioning
The User provisioning section controls how users whose email is on one of your verified domains join the workspace without a manual invite. There are three options.SSO sign-in
Automatically adds users to your workspace the first time they sign in through your SSO provider (also called just-in-time, or JIT, provisioning). Each provisioned user receives the provider’s JIT role, which you set on the SSO provider.- On the Enterprise plan, use the SSO Just-in-Time provisioning toggle to turn this on or off yourself.
- On the Business plan, this is enabled automatically when an SSO provider is configured, and the section shows a read-only Enabled or Disabled status. Contact Lovable support if you need it changed.
- When no SSO provider is configured yet, the row shows an Add SSO provider button instead.
Verified email sign-up
Automatically adds users who sign up to Lovable with an email on one of your verified domains, whether or not they sign in through SSO. Set the Default role that these users receive when they join.Verified email sign-up turns on automatically when you verify your first domain, with the default role set to editor. Review the default role after verifying a domain.
Add existing users
A one-time action that adds people who already have Lovable accounts with verified-domain emails to your workspace. The section shows how many eligible users were found; click Provision to add them all. Use this after verifying a domain to bring existing colleagues into the workspace in one step, instead of waiting for them to sign in or sign up again.How provisioning methods interact
- SCIM takes precedence. When SCIM provisioning is enabled, user creation and role assignment are managed from your identity provider, and verified email sign-up is disabled.
- Project invites respect provisioning. When you invite someone to a project and their email matches a verified domain with verified email sign-up on, they join the workspace as a full member at your default role instead of becoming an external collaborator.
- Provisioned members are managed like any other member. They appear in the People tab, where you can change roles, set credit limits, or remove them.
Enforce SSO and session duration
Once you have a verified domain and an SSO provider, you can turn on Enforce SSO to require all workspace members to sign in through your identity provider, and choose how long SSO sessions last (8 hours, 24 hours, 48 hours, or 7 days) before members must re-authenticate. For setup steps, the external-collaborator removal option, and troubleshooting, see Set up workspace single sign-on (SSO).Removal and cascade behavior
Identity settings depend on each other, so removing one piece can turn others off:FAQ
What's the difference between SSO sign-in and verified email sign-up?
What's the difference between SSO sign-in and verified email sign-up?
Both add verified-domain users automatically, but they trigger differently. SSO sign-in adds users when they first authenticate through your SSO provider and assigns the provider’s JIT role. Verified email sign-up adds users when they sign up with a verified-domain email using any sign-in method, no SSO required, and assigns the default role you set. You can use both at once.
Why can't I toggle SSO Just-in-Time provisioning?
Why can't I toggle SSO Just-in-Time provisioning?
The self-serve toggle is available on the Enterprise plan. On the Business plan, SSO sign-in provisioning is enabled automatically when an SSO provider is configured, and the status is shown read-only.
Why is verified email sign-up disabled?
Why is verified email sign-up disabled?
Verified email sign-up is disabled while SCIM provisioning is active, because SCIM manages workspace membership centrally from your identity provider. Disable SCIM if you want to switch to domain-based provisioning.
Does turning off a provisioning method remove members?
Does turning off a provisioning method remove members?
No. Turning off SSO sign-in, verified email sign-up, or SCIM only stops new automatic joins. Members who already joined keep their access until you remove them from the People tab.
What role do provisioned users get?
What role do provisioned users get?
Users added through SSO sign-in get the JIT role set on your SSO provider. Users added through verified email sign-up get the default role set in the User provisioning section. Users provisioned through SCIM get roles from your group mappings, or the SCIM default role. You can change any member’s role afterward from the People tab.