> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Directory Sync (SCIM)

> Automatically add and remove team members from your identity provider's directory

<Info>
  **Available on**: the Enterprise plan

  **Find it in**: Settings in the organization name menu at the top left of the screen > Organization > Enterprise Setup

  **Required role**: Admin or custom
</Info>

Directory Sync keeps your Profound organization's member list in sync with your identity provider (IdP) using System for Cross-domain Identity Management (SCIM) provisioning.

## How Directory Sync works

Once you connect a directory, it provisions everyone it lists into your Profound organization:

* **Assignments grant access.** When you connect a directory, everyone currently assigned to it is synced into your organization. After that, anyone your IdP assigns to Profound is provisioned automatically.
* **Unassignments remove access.** When your IdP unassigns or deactivates someone, their organization membership is removed and any pending invitation is revoked. Their Profound account itself isn't deleted: if they belong to other Profound organizations, those are unaffected.
* **New members start with the Member role.** People provisioned through Directory Sync get the [Member role](/platform-config/people/roles-and-permissions), and organization Admins can [change roles in Profound](/platform-config/people/add-and-manage-team-members) afterwards. If someone leaves the directory and is later reassigned, they return with the default Member role.
* **Members outside the directory can lose access.** When your IdP directory is the only membership source, any members you added manually on the [People page](/platform-config/people/add-and-manage-team-members) who aren't assigned in your directory lose access to your organization. To keep adding members from both sources, change the [membership source](#membership-source) setting.

### How new members sign in

How a new member signs in for the first time depends on your [Single Sign-On (SSO) setup](/platform-config/authentication/sso-overview):

* **With SSO enabled**, their account is created and they sign in directly through your IdP. No invitation email is sent.
* **Without SSO**, they receive an email invitation to create a password. The invitation stays valid for 30 days.

<Note>
  You don't need SSO to use Directory Sync. They are independent features: enable either one, or both.
</Note>

## Configure Directory Sync

To configure Directory Sync, you need the [Admin role](/platform-config/people/roles-and-permissions) in your Profound organization and administrative access to your IdP.

<Steps>
  <Step title="Locate the Directory Sync in ettings" id="step-1">
    1. In Profound, select your organization name at the top left of the screen, then select **Settings**.
    2. Select **Enterprise Setup** under **Organization** in the left navigation sidebar. The **Directory Sync** card shows your current sync status.
  </Step>

  <Step title="Configure your membership source" id="step-2">
    Review **Membership source** on the **Directory Sync** card:

    * Select the gear <Icon icon="gear" /> icon next to **Membership source**.
    * To keep existing members who aren't in your directory and continue inviting external users, choose **Directory & external users**.
    * To allow only members from your IdP directory, select **Directory only**.

    <Warning>
      With **Directory only**, members who aren't assigned in your directory will lose access as soon as the sync begins. Learn more in [Membership source](#membership-source).
    </Warning>

    Select **Save** and wait for the setting to save before continuing.
  </Step>

  <Step title="Open the Directory Sync configuration portal and follow the provider-specific instructions" id="step-3">
    On the **Directory Sync** card, select **Configure Directory Sync** to open the configuration portal.

    The portal tailors the setup to your directory provider, walking you through creating a SCIM integration in your IdP, connecting it to Profound, and choosing which people and groups to sync.
  </Step>

  <Step title="Test and verify" id="step-4">
    Use the portal's test step to verify the directory connection. Once syncing is live, the **Directory Sync** card on the **Enterprise Setup** page shows **Directory Sync Enabled** and your current [membership source](#membership-source). Select **Check status** to refresh, or **Manage Directory Sync** to reopen the configuration portal.
  </Step>
</Steps>

## Membership source

The **Membership source** setting governs your Profound organization membership once the directory is connected:

* **Directory only** (the default): your IdP manages all members. Anyone who isn't assigned in your directory loses access to your organization, including members you added manually before connecting the directory. Inviting people in Profound is disabled.
* **Directory & external users**: your IdP still provisions and removes the people it lists, and Admins can also invite people outside your directory in Profound. Use this option when people who aren't in your internal employee directory, such as agency partners or contractors, need a seat in your organization.

In both cases, your directory remains the source of truth for the people it lists. Members you add in Profound are external users: the directory never provisions or removes them, and you manage them on the [People page](/platform-config/people/add-and-manage-team-members).

### Change the membership source

[Admins](/platform-config/people/roles-and-permissions) can change the membership source at any time as instructed in [Step 2](#step-2) of the setup guide.

When a directory is connected, switching from **Directory & external users** to **Directory only** checks for external users. If any are found, the dialog shows how many may external users will lose access once the setting is changed.

<Note>
  Before a directory is connected, the membership source setup dialog doesn't show how many users are affected by the setting change. This does not mean that all existing members will retain access after you connect the directory. With **Directory only** any members outside the directory lose access.
</Note>

## Manage members with Directory Sync

Manage the members your directory lists through your IdP:

* The **People** page shows a banner explaining that people are managed by your identity provider.
* With the **Directory only** membership source, adding members, removing members, and revoking invitations are disabled in Profound. Make these changes in your IdP's directory instead.
* With the **Directory & external users** membership source, select **Add External User** on the **People** page to invite a user from outside your IdP directory. To invite several people at once, select **Add another user** or **Import from CSV**. Manage external users [from the People page](/platform-config/people/add-and-manage-team-members) in Profound.

Roles and category access are managed in Profound for everyone, regardless of the membership source. See [Add and manage team members](/platform-config/people/add-and-manage-team-members).

## Admin failsafe

Directory Sync always keeps at least one Admin in your organization. If your directory unassigns the organization's only Admin, that person keeps their access and role. This prevents a misconfiguration in your IdP, such as an incorrect group assignment, from locking everyone out of administering the organization.

To remove your organization's only Admin, first grant the Admin role to someone else. Once another Admin exists, the directory's unassignment takes effect normally.

## Notes

* Directory Sync is configured per Profound organization: each organization needs its own Directory Sync connection and membership source.
* Contact [customer support](mailto:support@tryprofound.com) if you need help during setup.