SSO & Identity is an Enterprise feature. Contact support@greptile.com to set it up for your organization.
Single Sign-On (SSO)
Members sign in to Greptile through your SAML 2.0 identity provider, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, or JumpCloud. Your admins manage access from the IdP. Before you can configure SSO, verify the domain your members sign in with. Greptile gives you a TXT record to add at your DNS provider, and verifies it once the record propagates.Auto Join
When Auto Join is on, anyone who signs in with a verified email on your organization’s domain is added to the organization automatically. When it’s off, members join by invitation.Require SSO (Beta)
Require SSO restricts access to members who signed in through your SAML identity provider. Password and Google logins still work as sign-in methods, but a session created with them can’t access the organization until the user authenticates via SSO. Enforcement is per-organization. A member who also belongs to a non-SSO organization keeps normal access to that organization.SCIM / Directory Sync (Beta)
Directory Sync provisions your organization from your identity provider over SCIM 2.0. People assigned in the IdP are added to Greptile, or invited if they don’t have an account yet, and people removed from the IdP lose access automatically. Existing members in the IdP are adopted by the sync and keep their current roles. Members outside the IdP are unaffected.1
Connect a directory
In your Greptile organization settings, connect a directory. Greptile generates a SCIM 2.0 base URL and a bearer token.
2
Configure your identity provider
Enter the base URL and token in your identity provider’s provisioning settings, and set the
userName attribute to each user’s work email. Greptile matches accounts by email.3
Enable provisioning
Enable provisioning of user creates, updates, and deactivations. Greptile uses updates to track account status, not to sync profile details. Deactivation in the IdP is what removes access.
4
Assign people
Assign the users or groups you want in Greptile to the app. Only assigned people are synced.
Group Mappings (Beta)
Map a group from your identity provider onto your organization or onto a team, and membership stays in sync automatically. People who leave the group lose the role the mapping gave them. A team mapping grants Member, Admin, or a team-scoped custom role. An organization mapping grants an organization-level custom role, never a built-in one. The directory owns the roles it manages, so the next sync reverts a role you change by hand. Mappings never change organization admins. Downgrades and removals wait until Greptile has read your groups in full, so a partial sync never strips access.Group mappings need your identity provider to push group memberships to Greptile in addition to provisioning users. Most providers configure this separately from user assignment, and the members of a pushed group must also be assigned to the app.