Set up SCIM user provisioning in Wispr Flow

Last updated: October 2, 2026

Available on: the web admin console (member profiles appear on Mac, Windows, and iOS)

Enterprise admins can connect an identity provider to Wispr Flow to create, update, and remove organization members automatically. Test a pilot group before assigning everyone.

Before you start

You need an Enterprise plan, an Admin or IT Admin role in Flow, an email address on your Flow admin profile, and administrator access to your identity provider.

Connect and activate SSO first; otherwise Configure SCIM is disabled with the tooltip “Connect and activate SSO to enable SCIM provisioning.” Non-admins cannot see this section; other plans show “Upgrade to Enterprise plan to use this feature”.

Warning: Connecting SCIM blocks manual additions and removals across the organization, including existing members, single/bulk invitations, invitation deletion, and join-request approvals. Automatic invitation acceptance and same-domain joining also stop. Denying a join request is still possible, but desktop hides both Approve and Deny.

Users on SCIM-managed domains cannot sign up directly—add them through your identity provider. If Flow cannot check the organization's signup policy, signup can proceed.

Set up directory sync

Configure SSO and Configure SCIM each open setup in a new browser tab.

Note: Activation does not import existing users automatically; your provider must send each user for creation. Every directory user is eligible regardless of group membership. Adding someone to a group alone does not create their Flow membership; removing them from a group does not remove access or free a seat.

  1. Open Organization settings in the Flow admin console.

  2. Click Configure SCIM beside SCIM Provisioning.

  3. Go to Directory Sync, select your identity provider, and enable directory sync.

  4. Map attributes as the portal instructs: email, first name, and last name.

  5. Wait for directory sync to activate.

  6. Assign a pilot group to the Wispr Flow application in your identity provider.

An email address is required; Flow prefers the primary address. Activation adds your provider organization's domains to Flow's domain list without verifying them. DNS verification is separate, is required for domain capture, and only verified domains are included in SSO setup.

Verify the setup

  1. Confirm the assigned user appears in Flow's admin console before assigning everyone else.

  2. Have them sign in using an authentication method your organization permits.

  3. Ask users in multi-team organizations to choose a team in the desktop team picker.

  4. Compare names and emails in Settings → Account on Mac or Windows, or the account profile on iOS.

Compare these details with your identity provider. Email is read-only; iOS combines first and last name for display.

Successful creation sends a welcome/invite email naming an existing admin as sender; without an admin, that notification is skipped. Review the enterprise audit log for SCIM member additions and removals.

Manage provisioned members

Warning: Deleting an entire directory group removes its users from the organization and revokes their pending invitations, subject to the removal safeguards below. This differs from removing one person from a group.

  • Roles: SCIM creates users as Member, preserves existing roles, and does not support role mapping. An admin can change an existing member's role in Flow.

  • Billing: New members increase seat counts and may increase your bill. A configured seat cap counts billable members and pending billable invitations. IT Admins are non-billable, do not count toward the cap, and receive no product access. In multi-team organizations, new users have no team membership and are not billed until they choose a team; counts can take time to update afterward. Contact support for seat reductions or adjustments; see Manage users and billing.

  • Removal: SCIM removes organization membership and revokes pending invitations, not the Flow account. Re-adding the same email reconnects that account. SCIM removal itself does not block rejoining or accepting invitations; organization access policies still apply. Manual admin removal instead blocks invite-link and automatic rejoining until an admin re-invites the person.

  • Desktop controls: With SCIM connected, Settings → Team hides Add new user and replaces Other domain users with a SCIM-managed message. Requests remain listed. This page has no member-removal control; admins can open Admin portal, and members can choose Contact admins.

Troubleshooting

Directory sync does not activate

Check that directory sync is enabled, your identity provider is connected correctly, and network or firewall rules allow it to reach Flow.

Complete the SSO prerequisite above, then retry Configure SCIM. If directory sync still cannot activate, contact support.

Users are not created

Domain, seat-cap, and other-enterprise blocks send no fallback invitation and do not retry automatically. A domain mismatch can leave your provider reporting success without a Flow member.

  1. Enable automatic provisioning, assign the user or group to the app, and check email or username mapping.

  2. Register the exact email domain: mail.example.com needs its own entry even when example.com is registered.

  3. Check any configured seat cap; increase it or free seats if it blocks the addition.

  4. Clear membership in another Flow enterprise first; users can belong to only one and are not moved automatically.

  5. Reassign the affected user after correcting the block, then check for them in Flow's admin console.

After correcting a domain, seat-cap, or creation failure, a provider attribute update can also retry creation—but only for an active user with no Flow account record, and not for an email rename. Contact support if the user remains absent.

Profile updates or account matching are wrong

Enable update provisioning as well as creation and deletion, confirm the user remains assigned, and check name and email mappings. Correct mismatches in your provider's attribute mappings.

Initial setup fills only empty name fields; later name updates replace existing values. Email changes and updates for inactive directory users are ignored without an error. Changing the provider email therefore does not correct the Flow email.

Flow reuses an account with the same email, ignoring capitalization. A different address sent by the provider can create a separate account.

Desktop names remain editable, but empty names are rejected and restored; names Flow treats as passwords, including values over 30 characters, cannot be saved. Compare the profile again after a valid name update.

A deactivated user still has access

Confirm the user was unassigned and a delete event reached Flow; deactivation alone may not send one.

Warning: Removal is blocked if it would leave no admin or no billable member. Your provider can report success while the person keeps access and occupies a seat; this removal does not retry automatically.

  1. Assign a replacement admin or retain another billable member, as required.

  2. Retry removal through your provider, then confirm the person is no longer a Flow member.

If no Flow account exists, removal revokes only the pending invitation. For sign-in that violates policy, use the sign-in checks below.

Users receive invitations instead of automatic provisioning

A temporary creation error can trigger an email invitation, which the user can accept. If no organization admin exists, this fallback invitation has no named inviter. Confirm membership after acceptance; contact support if this keeps happening.

Disconnecting or reconnecting SCIM

Deleting the directory-sync connection in the admin portal restores manual membership management and preserves memberships and pending invitations. Manual removal cannot remove your own account.

Warning: Disconnecting does not guarantee all additions stop: incoming user additions can still create members, while user deletions are ignored. After switching directories, changes from the previous directory are ignored and do not retry.

  1. Reconnect the directory through Configure SCIM after changing or re-linking your provider.

  2. Reassign users in the connected provider.

  3. Verify memberships against the provider's intended assignments.

Member counts do not match

On Mac or Windows, refresh Settings → Team. Counts appear only after team data loads; a failed refresh can leave stale counts without an error. For a changed provider, complete the reconnect steps above. If counts still differ, contact support to request a sync.

A provisioned user cannot sign in

Check the permitted sign-in method and organization membership. SCIM alone does not enforce SSO; SSO enforcement is separate and requires SSO login. Domain restrictions can block nonmembers.

SSO enforcement and domain restrictions require active Enterprise billing. If users can sign in against policy, check the subscription first; sign-in can also proceed if Flow cannot check these policies.

For an IP-allowlist lockout, connect from an approved network or contact your enterprise admin; see network troubleshooting. Retry sign-in after correcting access. Contact support if sign-in fails during account deletion or because Flow cannot find the account.

Still stuck?

Contact support for missing SCIM controls, unexpected membership changes, or persistent failures. Include your provider, enterprise domain, the affected user's email, your platform, and what you tried; for count mismatches, include both counts and the last provisioning time.

On desktop, choose Help → Get in touch → Talk to support; on iOS, choose Menu → Talk to Support.

Note: Desktop support submissions automatically include app logs. Desktop allows one image up to 10 MB; if sending fails, your message is copied to the clipboard.