JobsiteOn

Configure Enterprise SSO and SCIM

Prepare a verified company domain, single sign-on connection, and SCIM directory provisioning for a controlled Enterprise rollout.

Maya Thompson
Written by Maya ThompsonUpdated over a week ago3 min readAdvanced

Availability

Enterprise SSO and SCIM are in a controlled rollout. Your JobsiteOn implementation contact must confirm that your identity provider and production connection have completed acceptance testing before you enforce SSO for your company. A saved connection alone is not provider certification.

What the connection supports

JobsiteOn supports tenant-specific OIDC or SAML single sign-on and SCIM 2.0 Users and Groups provisioning.

Prepare your domain

Only a company Owner can manage enterprise identity. Your implementation contact provides a DNS TXT name and one-time value. Publish that exact record, then ask the Owner to verify it. SSO cannot be enabled until JobsiteOn finds the record.

Domain verification restricts JIT sign-in and SCIM provisioning to addresses on the approved company domain. Removing or changing an IdP claim does not let it cross into another company or Sandbox environment.

Test before enforcement

Keep enforcement off while you test:

  1. Sign in through the IdP with a pre-provisioned user.
  2. Confirm the user appears in the correct company and environment.
  3. Confirm the default role is correct and no IdP claim creates Owner or Admin access.
  4. Create, update, deactivate, and reactivate a SCIM test user.
  5. Create a SCIM group, replace its members, and confirm the matching Team.
  6. Test the company Owner's normal JobsiteOn login in a separate browser.

The active Owner login is the emergency break-glass path. When enforcement is on, other users on the verified domain must use SSO.

SCIM token handling

A SCIM bearer token is displayed once. Copy it directly into your identity provider's secure credential store. JobsiteOn keeps only a digest and cannot show the token again.

If the token is exposed, revoke it, create a replacement, and update the IdP. Deactivating a SCIM user suspends that company membership and revokes active JobsiteOn sessions. It does not delete attribution or evidence created by that person.

If sign-in fails

Did this answer your question?

Related Articles