> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seamind.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity & SSO

> Configure SSO, directory sync, and domain verification

The Identity page is where you configure how your organization authenticates and provisions users. Seamind uses WorkOS for identity management, which supports all major identity providers.

**Path:** Admin sidebar > **Identity**

## Overview

There are four configuration areas, each accessible via a **Configure** button:

1. **Domain Verification** — prove you own your company domain
2. **Single Sign-On (SSO)** — let crew sign in with your identity provider
3. **Directory Sync** — automatically create and deactivate users
4. **Certificate Renewal** — manage SAML certificates

<Info>
  Clicking **Configure** generates a link to the WorkOS Admin Portal and opens it in a new tab. Portal links expire after 5 minutes for security — if it expires, go back and click Configure again.
</Info>

## Domain Verification

Domain verification proves that your organization owns its email domain (e.g., yourcompany.com). This is required before you can set up SSO or directory sync.

### How to set it up

1. Click **Configure** next to Domain Verification.
2. The WorkOS Admin Portal opens in a new tab.
3. Follow the instructions to add a DNS TXT record to your domain.
4. Wait for verification (usually a few minutes, sometimes up to 24 hours depending on DNS propagation).

## Single Sign-On (SSO)

### Supported providers

SSO works with any SAML or OIDC identity provider, including:

* Okta
* Azure AD (Microsoft Entra ID)
* Google Workspace
* OneLogin
* PingFederate

### Prerequisite

Domain verification must be completed first.

### How to set it up

1. Click **Configure** next to Single Sign-On (SSO).
2. The WorkOS Admin Portal opens.
3. Select your identity provider from the list.
4. Follow the provider-specific instructions (typically involves copying metadata URLs and configuring attribute mappings).
5. Test the connection.

Once SSO is active, crew members sign in using your company's identity provider instead of a Seamind-specific password.

## Directory Sync

### What it does

Directory sync connects your identity provider's user directory to Seamind. When you add, update, or deactivate someone in your identity provider, those changes automatically appear in Seamind.

* **New user in directory** — crew member appears in Seamind
* **User deactivated in directory** — crew member status changes to Suspended
* **User details updated** — changes reflect in Seamind

### How to set it up

1. Click **Configure** next to Directory Sync.
2. The WorkOS Admin Portal opens.
3. Select your directory provider and follow the setup instructions.
4. Assign which groups should sync to Seamind.

### Important notes

* Directory sync runs automatically. You don't need to manually add crew members.
* Deactivating a user in your directory suspends them in Seamind — it doesn't delete their data.
* Role changes are managed in your identity provider, not in Seamind.

## Certificate Renewal

### When you need it

SAML certificates have expiration dates (typically 1-3 years). When a certificate is about to expire, you need to renew it to prevent SSO from breaking.

### How to renew

1. Click **Configure** next to Certificate Renewal.
2. The WorkOS Admin Portal opens.
3. Follow the renewal instructions — this usually involves generating a new certificate and updating it in your identity provider.

Your identity provider may also notify you when certificates are approaching expiration.

## FAQ

<AccordionGroup>
  <Accordion title="How do I make someone an admin?">
    Admin status is managed in your identity provider, not in Seamind. Update the user's role or group membership in Okta, Azure AD, or whichever provider you use. The change syncs to Seamind automatically.
  </Accordion>

  <Accordion title="How do I remove a crew member?">
    Deactivate them in your identity provider. Directory sync will update their status to Suspended in Seamind. Their training records are preserved.
  </Accordion>

  <Accordion title="I don't see the Configure button. What's wrong?">
    You need admin access. Contact your IT team or another admin to verify your role.
  </Accordion>

  <Accordion title="The portal link expired. What do I do?">
    Go back to the Identity page and click Configure again. Each click generates a fresh 5-minute link.
  </Accordion>
</AccordionGroup>