Set up SCIM user provisioning in Wispr Flow

Last updated: November 13, 2026

Available on: the web admin console (member profiles appear on Mac, Windows, and iOS)

Enterprise admins can connect an identity provider to Wispr Flow to create, update, and remove organization members automatically.

Before you start

You need an Enterprise plan, an Admin, Super Admin or IT Admin role in Flow, an email address on your Flow admin profile, and administrator access to your identity provider. Non-admins cannot see this section; organizations without Enterprise access see an Enterprise badge and a disabled Configure SSO button.

Connect and activate SSO first. Otherwise Configure SCIM is disabled with “Connect and activate SSO to enable SCIM provisioning.”

Warning: Connecting SCIM blocks manual member additions and removals, single/bulk invitations, invitation resends and deletion, and join-request approvals, which return “User management is controlled by your identity provider via SCIM. Please add or remove users through your identity provider.” Automatic same-domain joining stops on every sign-in method, including email and password and email one-time codes; pending invitations that would have auto-accepted are discarded.

Users on SCIM-managed domains cannot sign up directly—add them through your identity provider. If Flow cannot check the organization's signup policy, signup can proceed.

Set up directory sync

Configure SSO and Configure SCIM open separate setup portals in new browser tabs. Provider selection, directory-sync setup and attribute mapping happen in the SCIM setup portal, not in the Flow admin console.

  1. Open Organization settings in the Flow admin console.

  2. Click Configure SCIM beside SCIM provisioning.

  3. Go to Directory Sync.

    1. Select your identity provider.

    2. Enable directory sync.

  4. Map attributes as the portal instructs: email, first name, and last name. An email address is required: Flow uses your provider's main email address first, otherwise the primary address in the provider's email list.

  5. Wait for directory sync to activate.

  6. Assign a pilot group to the Wispr Flow application in your identity provider.

Activation, including reconnection, adds new provider-organization domains to Flow without verifying them. DNS verification is separate, is required for domain capture, and determines which domains are included in SSO setup.

Note: Activation does not import existing users; your provider must send each user for creation. Group membership does not determine eligibility, so adding someone to a group alone does not create their Flow membership. Email, domain, seat-cap, existing-membership and directory restrictions are covered under “Users are not created”.

Verify the setup

  1. Confirm the assigned user appears in Flow's admin console before assigning everyone else.

  2. Have them sign in using an authentication method your organization permits.

  3. Ask users in multi-team organizations to choose a team in the desktop team picker. Until they do, they have no team membership and are not billed; counts can take time to update afterward.

  4. Compare names and emails with your provider: Mac/Windows: Settings → Account; iOS: the account profile. Email is read-only, and iOS combines first and last name for display.

Successful creation sends a welcome/invite email naming an existing admin as sender; without an admin, that notification is skipped.

Membership and billing

  • Roles: SCIM creates users as Member, preserves existing roles, and does not support role mapping. Admins can change roles in Flow; changing a non-billable role to a billable role re-checks the seat cap.

  • Seats: New members may increase your bill. A configured seat cap counts billable members plus pending billable invitations; pending invitations are not billed, and billing starts after acceptance and team membership. Revoking stale invitations frees cap capacity, but manual revocation is blocked while SCIM is connected. Contract-managed caps are not self-service settings. IT Admins are non-billable, do not count toward the cap, and receive no product access. Contact support for seat reductions or adjustments; see Manage users and billing.

  • Accounts: SCIM removal ends organization membership and revokes pending invitations, not the Flow account; re-adding the same email reconnects that account. SCIM removal does not block rejoining or invitation acceptance, though organization policies still apply. Manual admin removal instead blocks invite-link and automatic rejoining until an admin re-invites the person.

Warning: Removing one person from a directory group does not remove access or free a seat. Deleting the entire group removes its users and revokes their pending invitations, subject to these safeguards: removals and role changes cannot leave the organization without an admin-level user (Admin, Super Admin or IT Admin) or a billable member. A blocked SCIM removal leaves the member's access and seat unchanged—even if the provider reports success—with no automatic retry, admin email or in-product error. A blocked group removal removes no one.

Troubleshooting

Directory sync does not activate

Check that directory sync is enabled, your identity provider is connected correctly, and network or firewall rules allow it to reach Flow.

  1. Complete SSO setup; its button reads Configure SSO, Finish setup or Manage SSO depending on connection status.

  2. Click the refresh icon beside the SSO / SAML authentication label to re-check the connection after changing your SSO configuration; a status icon shows messages such as “SSO setup is in progress” or “Unable to connect” in a tooltip.

  3. Retry Configure SCIM after “Single sign-on is active.” appears.

If directory sync still cannot activate, contact support. Also contact support for “This domain is already linked to another organization. Contact support.”

Users are not created

A missing email prevents creation. Domain mismatches, seat-cap limits, membership in another Flow enterprise and changes from a different linked directory send no fallback invitation and do not retry automatically; a domain mismatch can leave your provider reporting success without a Flow member.

  1. Enable automatic provisioning in your provider.

    1. Assign the user or group to the app.

    2. Check email or username mapping.

  2. Register the exact email domain: mail.example.com needs its own entry even when example.com is registered. A domain deleted in Flow stops matching even if it remains in your provider.

  3. Check any configured seat cap; increase it or free seats if it blocks the addition.

  4. Clear membership in another Flow enterprise first; users can belong to only one and are not moved automatically.

  5. Re-link a rotated or re-created directory using “Disconnecting or reconnecting SCIM” below.

  6. Reassign the affected user after correcting the block, then check for them in Flow's admin console.

After correcting a block, an attribute update can retry creation for an active user with no Flow account record, but not for an email rename. An active-state change can also re-add an existing account with no organization, unless an admin previously removed that member. Contact support if the user remains absent.

Profile updates or account matching are wrong

Initial setup fills only empty name fields; later updates replace existing names. Email changes are ignored without an error, so changing the provider email does not correct the Flow email. For an existing account, an inactive status triggers removal rather than a profile update, subject to the removal safeguards.

  1. Enable update provisioning as well as creation and deletion.

  2. Confirm the user remains assigned.

  3. Correct mismatches in your provider's name and email attribute mappings.

  4. Compare the profile again after a valid name update.

Flow reuses an account matched by email; a different address sent by the provider can create a separate account.

A deactivated user still has access

Deactivation alone does not send a user deletion; Flow also acts on inactive-user updates. Removal requires the current directory to remain linked.

  1. Confirm the user was unassigned and Flow received a user deletion or an inactive-user update.

  2. Assign a replacement admin or retain another billable member if a removal safeguard blocks the action.

  3. Retry removal through your provider, then confirm the person is no longer a Flow member.

If no Flow account exists, removal revokes only the pending invitation. Directory deletion skips a never-signed-in SCIM profile that is not yet linked to a sign-in account.

Users receive invitations instead of automatic creation

Other creation failures can trigger an invitation instead, unless the invitation itself exceeds the seat cap. Without an organization admin, this fallback invitation has no named inviter. If email delivery fails, nothing arrives to accept.

  1. Ask the user to accept the invitation explicitly, using the addressed email, within its 180-day validity.

  2. Confirm membership after acceptance; contact support if this keeps happening.

Disconnecting or reconnecting SCIM

Deleting the directory-sync connection restores manual membership management and preserves memberships, pending invitations and the organization's domain list. Manual removal cannot remove your own account.

Warning: Disconnecting does not guarantee additions stop: incoming user additions can still create members, while user deletions and deactivations are ignored. While SCIM is disconnected, people signing in with any method—including email and password or an email one-time code—can again accept a pending invitation or be added automatically if your organization's domain matches and automatic invitations are on. After switching directories, user additions and removals from the previous directory are ignored without retry.

  1. Reconnect the current directory through Configure SCIM.

  2. Reassign users in the connected provider.

  3. Verify memberships against the provider's intended assignments.

Reconnection does not import a roster: membership changes only when the connected provider sends user additions or qualifying updates.

Desktop controls or member counts differ

On Mac and Windows, open Settings → Team; SCIM removes the sidebar Team shortcut, hides Add new user, and leaves requests listed without Approve or Deny. The domain-user list is replaced with “User management is controlled by your identity provider via SCIM. Please add users through your identity provider.” This page has no member-removal control: admins can choose Admin portal to open admin.wisprflow.ai in a browser; members can choose Contact admins.

  1. Refresh Settings → Team to check the counts.

  2. Complete the reconnect steps above if you changed providers.

  3. Contact support to request a sync if counts still differ.

Counts appear only after team data loads; a failed refresh can leave stale counts without an error.

A provisioned user cannot sign in

Check the permitted sign-in method and organization membership. SCIM alone does not enforce SSO; SSO enforcement is separate, appears below SCIM provisioning in Organization settings, and requires SSO login. Domain restrictions can block nonmembers.

SSO enforcement and domain restrictions require active Enterprise billing, so check the subscription first if users sign in against policy. Sign-in can proceed if Flow cannot check these policies, and a recently joined member can be temporarily rejected; retry sign-in shortly afterward.

For an IP-allowlist lockout, connect from an approved network or contact your enterprise admin; see network troubleshooting. An already-approved network works immediately; allowlist edits are not. Retry sign-in after correcting access.

If account deletion is in progress, retry shortly after deletion finishes. For a temporary sign-in-unavailable error, retry shortly. Contact support if sign-in fails because Flow cannot find the account.

Still stuck?

Contact support for missing SCIM controls, unexpected membership changes, or persistent failures. Include your provider, enterprise domain, the affected user's email, your platform, and what you tried; for count mismatches, include both counts and the last provisioning time.

On desktop, choose Help → Get in touch → Talk to support; on iOS, choose Menu → Talk to Support.