Let your directory own who is in.

A connection is the endpoint one provider provisions into. It has a source preset (Entra, Okta, or generic SCIM), a default role every provisioned person receives, a base URL the provider is pointed at, and bearer credentials the provider presents. Roles that can administer the workspace are refused as a default, so a directory can never mint an admin. A connection is created disabled and refuses every request, including the provider's connection test, until you enable it; disable it again to shut the door without anyone losing access.

A directory provisions a member only for an address inside a domain the workspace has verified on the Enterprise SSO page. Anything else is recorded as a pending entry with no access until the person signs in through your identity provider or an admin confirms the entry from the Directory page.

Minting a credential shows the plaintext token exactly once. Telos stores a hash and lists only the token's prefix afterwards, so copy it into the provider before dismissing the panel. Revoke a credential to refuse the provider's next request with it. Rotate revokes and mints a replacement in one step, for a token you already consider burned; for a zero-downtime swap, mint a second credential, reconfigure the provider, then revoke the first.

Only one directory holds authority: it creates people, ends their access, and restores it. A second connection is staged alongside it and records its own entries and leavers without touching anyone's access. When the staged directory has completed a sync, choose Move authority here. Telos previews every join, link, deactivation, and pending entry the handoff would make, and lists any conflict that blocks it, such as a seat limit or a handoff that would end your own access.

You confirm the exact plan you previewed. If the staged directory changed in between, the handoff refuses and asks you to preview again. Each handoff is recorded under Authority handoffs. The latest one can be handed back while nobody's access has changed: hand back reverses the authority flags and restores the previous directory, and it is refused once the handoff joined or deactivated someone or either directory has synced since. To walk such a handoff back, run a new cutover to the previous directory; it recomputes and previews the delta like any other.

In the Entra admin center open the enterprise application, choose Provisioning, and set the mode to Automatic. Paste the connection's SCIM base URL as the Tenant URL and the minted token as the Secret Token, then test the connection. Keep user provisioning on and turn group provisioning off: groups are not implemented. Leave the objectId → externalId mapping in place; it lets Telos link a person to their Entra sign-in by proof. A DELETE from Entra deactivates the person and keeps the entry. This preset has not yet been validated against a live Entra tenant; treat the first one as a validation exercise.

In the Okta application open Provisioning and Configure API Integration. Use the connection's SCIM base URL as the connector base URL, userName as the unique identifier, and HTTP Header authentication with the minted token. Enable Push New Users, Push Profile Updates, and Deactivate; leave Push Groups off. Okta deprovisions by setting active to false, which ends the person's access; a DELETE is refused because Okta never sends one. Okta cannot prove which sign-in identity an entry is, so entries outside a verified domain wait for a login or your confirmation. This preset has not yet been validated against a live Okta org.

Use the generic preset for a SCIM 2.0 client Telos has no vendor knowledge of. The endpoint is the connection's base URL with a bearer token; externalId is required on create, only the userName and externalId equality filters are supported, and there are no Groups, Schemas, or bulk endpoints. A DELETE deactivates and keeps the entry. Google Workspace is not a supported source: it does not provision outbound over SCIM to arbitrary endpoints, so Google sign-in works and Google provisioning does not.

If the Enterprise plan lapses, existing connections keep syncing and the Directory page stays reachable for the security exits: disable a connection, revoke a credential, adopt or detach an entry, and hand a handoff back. Creating connections, minting or rotating credentials, and moving authority need the plan again.