Single Sign-On, SCIM and the Security Controls Your IT Team Asks For

Before an IT team lets a tool hold the keys to the company's apps, it asks the same handful of questions. Can people sign in with our identity provider? When someone leaves, are they out the same day, without anyone remembering to remove them? Can we require two-factor authentication? Can we limit access to our own network? Where does the activity log go?

This week's release answers each of them. Pro and Enterprise workspaces can now sign people in through their identity provider, add and remove members automatically, and set the rules everyone in the workspace works under. And every account, on every plan, can now protect itself with an authenticator app.

Sign in through your identity provider

SAML single sign-on connects Lodol to the identity provider your company already runs, such as Okta or Microsoft Entra, or any other provider that speaks SAML. It comes down to three things:

1. Verify your company's email domain. This proves the domain is yours, so your identity provider is only trusted for your own people's addresses.
2. Connect your provider from its metadata. Lodol takes the details it needs from your provider's metadata.
3. People sign in with Continue with SSO. They go through your provider, with whatever checks it already applies.

Then, when you're ready, turn on Require single sign-on, and members can only come in through your provider. The workspace's owner always can, so an expiring certificate never locks the whole workspace out, and Lodol warns you before the certificate expires. That owner account is your way back in on a bad day, so protect it with an authenticator app (more on those below).

Joiners and leavers, handled by SCIM

Single sign-on decides who can get in. SCIM keeps the member list itself in step with your directory. Your identity provider now adds people to the workspace when they join and removes them when they leave, so an offboarding checklist has one less line on it, and nobody keeps access because a form was missed.

Roles come from your groups too. Map each group in your identity provider to a role in Lodol, such as Finance to a custom role that can run workflows but not edit them, and IT to Admin. When someone is in more than one group, the first match in your list wins. From then on, each person's role follows their group: move someone between teams in your directory and their access in Lodol changes with it, without them signing out and back in.

SCIM tokens belong to the workspace, not to the person who created them, so provisioning keeps working after that person moves on.

Rules for everyone in the workspace

Security settings now set the rules every member works under:

• Require two-factor authentication, and choose which kind.
• Accept new members only from your company's email domains, so nobody joins from a personal address.
• Allow access only from the IP addresses you list, API keys included, so a key that leaks is no use outside your network.
• Sign people out after a stretch of inactivity, for laptops left open in shared spaces.

One safeguard is built in: Lodol won't save an IP allowlist that would shut you out, so you can't lock the door with yourself on the wrong side of it.

An audit log that goes where your team looks

Lodol's audit log records who did what in the workspace: integrations installed and changed, API keys created and revoked, workflows rolled back or copied to another workspace, approval decisions, subscription changes and more. Since July you can filter it by category, action and person over any date range, and download exactly what's on screen.

Now it can also go straight to the tools your security team already watches. Stream every audit log entry to Datadog, Splunk, Sentry or any HTTPS endpoint, within seconds and in order, with up to three streams per workspace. Each stream shows when it last delivered, and what the destination said when it couldn't, so a broken stream doesn't fail quietly.

Authenticator apps and recovery codes, for everyone

Two-factor authentication now works with any authenticator app as well as with emailed codes, on every plan. Turning it on gives you 10 single-use recovery codes. Keep them somewhere safe, away from your phone: they're how you get back in if the phone is lost.

What was already in place

This release builds on controls Lodol already had, which your IT team will want to know about too:

• Custom roles on Pro and Enterprise, built from permissions like Run workflows, Edit workflows, Manage integrations and View audit logs, so each person gets exactly the access their work needs.
• Every device, in one list. Signed-in Devices shows every device signed in to your account and when each was last active, so one you don't recognize stands out, and Sign Out Everywhere signs them all out in a click.
• No guessing your way in. Sign-in attempts are limited, five wrong sign-in codes in a row lock the account for 30 minutes, and signing in never reveals whether an account exists.
• Passwords that hold up. New passwords need mixed case, a number and a symbol, common passwords are turned away, and a new password can't repeat any of your last five. Changing it signs you out on every other device.
• Alerts for new sign-ins, with when it happened, the device and the rough location.
• API keys with only the access they need. Each key gets just the scopes it needs, is shown once and stored only as a hash, and revoking it ends its access straight away.

What it doesn't do

Single sign-on decides who gets into the workspace. What each person can do once they're in is still up to their role, so it's worth looking at your roles before you map groups to them. And requiring single sign-on leaves the owner's own sign-in in place on purpose. That's the way back in when a certificate expires, not a gap.

Bring your IT team in.
Send them our Enterprise page and our security overview, or talk to us and we'll walk through single sign-on, SCIM and your security review together. Start free if you'd like to look around first.