> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zas.red/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO and SCIM Provisioning in Zas Enterprise

> Zas Team supports SAML and OIDC SSO. Enterprise adds SCIM provisioning and deprovisioning. Departure uses a grace window and live device claim, not a new account.

Zas Team supports SAML and OIDC single sign-on. Enterprise adds SCIM provisioning and deprovisioning, so your identity provider can create and remove Zas accounts automatically.

## SSO on Team

<Steps>
  <Step title="Open org settings">
    As an admin, go to your organization settings in Zas.
  </Step>

  <Step title="Choose SSO provider">
    Select **SAML** or **OIDC** and enter your provider metadata or discovery URL.
  </Step>

  <Step title="Test and enable">
    Run a test login with a non-production account, then enable SSO for all members.
  </Step>
</Steps>

## SCIM on Enterprise

SCIM is available on the Enterprise tier. It connects your identity provider to Zas for automatic user provisioning and deprovisioning.

### What SCIM does

* **Creates accounts** when a user is added to the Zas app in your IdP
* **Updates roles** when group mappings change
* **Deprovisions users** when they are removed from the IdP

### SCIM deprovisioning

When SCIM deprovisions a user, everything that person had in transit leaves today. Their items are removed immediately, not at natural expiry. This is by design: corporate data should not outlive the employee's access.

## Departure and identity recovery

If a user loses their corporate-only identity (for example, after SCIM deprovisioning or org removal), Zas does not force them to create a new account. Instead, they enter a grace window and use a live device claim flow. The user frame is: "Your Zas is still yours."

<Info>
  SSO sits in Team on purpose. We believe centralized sign-in is a baseline feature, not an Enterprise upsell.
</Info>

## What to read next

* [Team vs Enterprise comparison](/en/enterprise/team-vs-enterprise)
* [Domain proof setup](/en/enterprise/domain-proof)
* [Identity model](/en/enterprise/identity-model)