Identity and access
Business workspaces can add managed SAML, SCIM provisioning, and a custom
access domain. Only a workspace owner can configure these features.
| Feature | Purpose |
| Managed SAML | Sign users in through the identity provider for a verified company domain |
| SCIM | Provision and deactivate workspace users from Microsoft Entra |
| Custom access domain | Serve the workspace portal and MCP endpoint from a company-controlled hostname |
These features solve different jobs. A custom hostname does not configure
sign-in, and SAML does not provision or remove users.
For a managed customer, the customer identity package supplies that customer's
separate identity configuration and custom access domain. Configure it from the
customer context; do not reuse the MSP's identity metadata or SCIM token.
Change control
Before changing identity:
- Confirm the selected workspace and verified domain.
- Preserve an existing administrator access path.
- Schedule provider-side changes and Stackyapper changes together.
- Test with a non-owner user before broad rollout.
- Review the resulting identity change in Audit.
Never send SAML metadata containing secrets, SCIM bearer tokens, or session
data to support.