SSO and directory sync

Enterprise plan. Owner and Admin.

On Starter or Growth, upgrade in Billing. If you leave Enterprise, company login stops and the connection is removed. Staff sign in with email until you upgrade again.

What you get

1. Staff sign in to Bruchim with their company login (SSO).
2. Directory Sync creates, updates, and deactivates people on Users.
3. Optional: an identity-provider attribute (for example Entra Office) sets Primary location and Host locations.

Directory Sync does not change Bruchim roles. New people join as Employee. You promote Owner, Admin, Location Manager, or Reception on Users.

Turn on SSO

1. Open the workspace switcher → Manage organization → Security.
2. Add and verify your company domain.
3. Choose your identity provider, finish SAML or OIDC, test, then turn the connection on.

You should see SSO with Active and your domain. That tab does not include Directory Sync.

Only Owners and Admins can open Security.

You can also add a connection from Settings → General → Add connection.

Bruchim Staff (email [email protected]): if you do not see Security, ask us to enable enterprise SSO. Include the workspace name. Then sign out and in once.

After SSO is on, staff use the usual Bruchim sign-in screen with their company login.

Directory Sync

You cannot turn this on from Settings.

1. Finish SSO so the connection shows Active.
2. Email [email protected]. Ask Bruchim Staff to turn on Directory Sync. Include the workspace name and the company domain.
3. We send a provisioning URL and a secret token. You only get the token once. Store it like a password.
4. Your identity-provider admin pastes those into the app's provisioning settings, assigns people, and turns provisioning on.

If people should appear only from the directory (not on first sign-in), say so in the same email.

Microsoft Entra (including Office location): Microsoft Entra ID.

After people appear

• People from Directory Sync show a Directory sync badge on Users, including when primary location is blank.
• Full name and Work email are read-only. Hover those labels for Updated from your identity provider. Title, phone, and host eligibility stay in Bruchim unless the host policy below overwrites hosts.
• Turning someone off in the identity provider deactivates them here and removes app access. They stay in the directory as deactivated.
• New people join as Employee unless you already invited them with another role. Promote Owner or Admin on Users. They keep Manage organization → Security.

If someone is in your directory but not on Users, email [email protected]. They can also try signing in once.

Primary location and host locations

On Settings → General → Single sign-on & directory sync, two independent rules (each collapsible):

	Primary location	Host locations
All locations	No primary	They can host at every site (empty host list)
One default location	That site	They can host at that site
From an identity-provider attribute	One location per attribute value	One or more locations per attribute value

The two rules do not have to match. You can set primary from one default and hosts from an attribute, or use different attribute keys.

Unmapped values use If the value is not mapped (a fallback location, No primary / All locations if you leave it blank).

Directory-synced people get these rules on each sync, including when the attribute changes. People you invited or edited by hand keep the locations you set, unless they are marked Directory sync.

See Host and Admin locations.

Map an identity-provider attribute

Bruchim Staff map the directory field (for example Entra Office) to an attribute name such as office. Email [email protected] if that is not done yet.

Then in Settings, open Primary location and/or Host locations:

1. From an identity-provider attribute.
2. Attribute key: the name we gave you (office).
3. Select Add mapping. Enter the attribute value (for example Toronto HQ) and the Bruchim location.
4. On Host locations, Add location if that value should map to more than one site.

The key is the name we mapped, not the field name inside Entra or Okta.