---
title: "Business sign-on and provisioning · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning
updated: 2026-10-20
licence: "All rights reserved"
---

# Business sign-on and provisioning

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Let each business customer bring its own identity provider, add and remove users through SCIM, and act on the security signals it sends.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning`.

## Required

- [Remove access at once when the directory says so](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/deprovision): When a customer's directory deactivates or deletes a user, end that user's sessions and tokens in the organisation within 1 minute, and keep their work.

## Recommended

- [Connect single sign-on per organisation](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/organisation-sso): Let each business organisation connect its own identity provider through SAML 2.0 or OpenID Connect, and route its users there by verified email domain.
- [Let organisations require single sign-on](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/require-sso): Let an organisation require its single sign-on for every member with its domain. Keep one owner with a passkey who can sign in without it.
- [Provision users with SCIM](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/scim-provisioning): Offer SCIM 2.0, as RFC 7643 and RFC 7644 define it, so a customer's directory creates, updates and removes users and groups.
- [Map directory groups to roles](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/group-role-mapping): Let organisation admins map their directory groups to your roles, and apply the mapping on every SCIM change and every sign-in.

## Optional

- [Listen for security signals from the customer's provider](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/shared-signals): Receive OpenID Shared Signals events from customers' identity providers, and end sessions when they report a revoked session or a disabled account.

- Previous: [Profile and account lifecycle](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle)
- [All chapters](https://agentwranglers.se/playbook/accounts)