Skip to content
Arcane CRMArcane CRMHelp

Atlas

Answers from this help and cites its sources. 20 questions a day.

SSO and SCIM

With enterprise SSO, people with your e-mail domain sign in to Arcane CRM through your identity provider (Okta, Microsoft Entra, Google…), with the Continue with SSO button. SCIM lets your directory suspend and restore their access.

Depending on your plan Settings › Team and access › SSO The Owner and Admins
123456
  1. 1The connection
  2. 2Values for your provider
  3. 3Domain verification
  4. 4Options
  5. 5SCIM provisioning
  6. 6Delete the configuration
Hover a number to locate the area. Click the screenshot to enlarge it.
The SSO page: the OIDC connection with domain, issuer and client, the values for your provider, domain verification with a TXT record, the Require SSO and Automatic join options, SCIM provisioning and deleting the configuration.

An organization has a single SSO connection, for a single e-mail domain.

Set up the connection

Section titled “Set up the connection”
  1. In the Values for your provider card, copy the values and create the application at your provider:
    • with OIDC, the Redirect URL;
    • with SAML, the ACS URL and the Entity ID (or the Metadata URL). The NameID must be the e-mail address.
  2. Back in the Enterprise SSO card, choose the Protocol and enter the Email domain.
  3. Fill in what your provider gives you:
    • with OIDC: Issuer, Client ID and Client secret;
    • with SAML: the provider’s XML metadata, or else the SAML sign-in URL, the Provider entity ID and the X.509 signing certificate.
  4. Click Save. The secret and the SAML configuration are not shown again afterwards: leave the fields empty to keep them.

Verify the domain

Section titled “Verify the domain”

Prove the domain is yours: add the TXT record shown at your DNS host (name _arcane-crm.<your domain>, value arcane-crm-verification=…), then click Verify. The card then shows the verification date.

Changing the domain resets its verification. Changing the protocol or the domain also forgets the accounts already linked to SSO and the SCIM data.

Options

Section titled “Options”
  • Require SSO: blocks password, sign-in link, Google and Microsoft for addresses in the domain. It needs a verified domain. Sessions already open stay valid.
  • Automatic join: a new employee of the domain joins the organization at their first SSO sign-in, with the chosen role (Member or Viewer) and records (Their own records or All records), if a seat is left.

Click Save options.

SCIM provisioning

Section titled “SCIM provisioning”
  1. Once the domain is verified, click Create a token.
  2. Copy the token right away: it will not be shown again.
  3. Paste the SCIM address and the token into your directory (Okta, Microsoft Entra or Google).

When the directory deactivates or deletes a person, their access to the organization is suspended and their seat freed. It comes back when the directory reactivates them. Only addresses in the domain are accepted, and directory groups have no effect.

Regenerate creates a new token and refuses the old one at once: replace it in the directory. Revoke stops the directory from adding, changing or suspending members.

Delete the configuration

Section titled “Delete the configuration”

Delete the configuration removes the SSO connection, the domain verification and the SCIM token. Addresses in the domain can no longer sign in with SSO. This cannot be undone.