User provisioning and access control from your identity provider
TL;DR
In Pantheon Enterprise, access is granted in your identity provider. Assign someone to the Pantheon app and their account is created the first time they sign in, already inside your company's workspace. Admins set roles and remove members in Pantheon. Automatic offboarding driven by your directory (SCIM) is built on request.
On this page
Accounts appear on first sign-in
There is no seat spreadsheet to keep in sync. When someone you have assigned in Google Workspace, Microsoft Entra ID or Okta signs in for the first time, Pantheon creates their account and adds them to your company's workspace. This only happens for a person who signed in through your company login. A matching email address alone never lets anyone in.
People outside your directory, such as advisors or outside counsel, are invited by email instead, and see only what they are invited to.
Roles and removal
Workspace owners and admins manage the member list in Pantheon: change a person's role, or remove them from the workspace. Removing someone ends their access to the company's workspace; their own personal space, if they have one, stays theirs.
When someone leaves the company, unassigning them in your identity provider stops them signing in through your company login. Removing them in Pantheon as well ends their workspace membership. With SCIM (on request), your directory does both for you.
Two-factor policy
Your identity provider's second factor counts for company sign-in. For anyone who signs in another way, such as an invited guest, the workspace can require two-factor sign-in before the workspace opens.
What is standard and what is on request
Standard means it is part of every Pantheon Enterprise deployment today. On request means we build it for your deployment once you ask, and support it from then on.
| Capability | Availability | What it means |
|---|---|---|
| Access by identity-provider assignment | Standard | Assign the Pantheon app in your admin console. |
| Accounts created on first company sign-in | Standard | Only for people who signed in through your login. |
| Roles, change role, remove member | Standard | Managed by workspace owners and admins. |
| Guest invitations | Standard | Advisors and outside counsel by email invite. |
| Require two-factor sign-in for the workspace | Standard | Applies to anyone not signing in through your identity provider. |
| SCIM directory sync and automatic offboarding | On request | Your directory adds and removes members for you. |
| Group-to-role mapping from your directory | On request | Roles follow the groups you already keep. |
Does Pantheon support SCIM?
Not as standard today. Accounts are created on first sign-in through your identity provider, and admins remove members in Pantheon. SCIM directory sync, including automatic offboarding, is built for your deployment on request.
Can someone get in just because they have our email domain?
No. An account joins your company workspace only after signing in through your company login. A matching email domain alone is never enough.
What happens to a person’s data when they are removed?
They lose access to the company workspace. Records are soft-deleted rather than erased, under the retention rules on records and retention.