For enterprise organizations, Leanmote supports single sign-on (SSO) and automated user provisioning (SCIM). Both are configured under Administration → Settings → Identity.
Single sign-on (SSO)
SSO routes Leanmote authentication through your identity provider (Okta, Azure AD, Google Workspace, OneLogin, etc.). After enabling SSO:
Users sign in via your IdP rather than email/password.
Account creation can be configured to be automatic on first SSO login (Just-In-Time provisioning).
Deprovisioning in your IdP revokes Leanmote access automatically.
Setup follows your IdP's standard flow — Leanmote provides the SSO endpoint and certificate; your IdP admin registers Leanmote as an application.
SCIM
SCIM (System for Cross-domain Identity Management) automates user lifecycle:
New users are created in Leanmote when added to your IdP group.
Role and team assignments are kept in sync.
Users are deactivated when removed from the IdP group.
The SCIM endpoint and bearer token live on the Identity settings page. See the SCIM Handler reference for the full attribute mapping.
Plan-tier note
SSO and SCIM are typically Enterprise-tier features. Confirm availability with your account team if the settings page doesn't show these sections.
Migration tips
Enable SSO first, then SCIM. SSO without SCIM is fine; SCIM without SSO is unusual.
Run SCIM in dry-run / log-only mode for the first day if your IdP supports it. Verify the user list before flipping to enforcement.
Keep at least one Leanmote-native admin who isn't SSO-only, so a misconfigured IdP doesn't lock everyone out.
Related articles
Users management
Roles and access levels
Working with the Leanmote API