Single Sign-On & SCIM

Configure enterprise sign-in and keep Rox users and groups synchronized with your identity provider.

SSO controls how people sign in to Rox. SCIM controls which users and groups exist in Rox and keeps them in sync with your identity provider.

SSO works on its own. It uses just-in-time (JIT) provisioning to create users at first sign-in. By default, JIT syncs the user's profile from the IdP at every sign-in. Turning on SCIM turns JIT off automatically. SCIM requires SSO.

We recommend setting up SSO and SCIM in one wizard. The combined flow is not generally available. Contact your Rox account team or support to enable SCIM and the combined wizard.

Enterprise SSO via Auth0: Set up sign-in first.
SCIM provisioning: Sync users and groups.
Map groups to roles: Grant Rox roles through IdP groups.

Single sign-on (SSO) controls how people sign in to Rox. SCIM provisioning controls which users and groups exist in Rox and keeps them synchronized with your identity provider.

These capabilities are available on Enterprise workspaces. SSO works independently. SCIM requires SSO.

Choose your setup

Setup	How users join	Where you manage access
Without enterprise SSO	Admins add members in Rox. Users sign in using the workspace’s existing sign-in method.	Manage members directly in Rox.
SSO only	Rox creates users at first sign-in through just-in-time (JIT) provisioning.	Manage sign-in access in your identity provider.
SSO and SCIM	Your identity provider provisions users before their first sign-in and synchronizes users and groups.	Manage provisioned users and group membership in your identity provider. Manage Rox roles in Rox.

With SSO alone, JIT provisioning creates users at first sign-in and, by default, updates their profile from the identity provider at each sign-in. Enabling SCIM automatically disables JIT provisioning.

We recommend configuring SSO and SCIM together. SCIM and the combined setup wizard require enablement by Rox and are not generally available. Contact your Rox account team or support to enable them.

Supported protocols and providers

Capability	Protocol	Identity providers	Direction
SSO	SAML 2.0 through the Auth0 setup wizard	Okta and Microsoft Entra ID	Users can start from Rox or their identity provider.
SCIM	SCIM 2.0	Okta and Microsoft Entra ID	Identity provider to Rox only.

For Microsoft Entra ID, select Custom SAML in the SSO wizard.

Match identities across SSO and SCIM

The SAML NameID and SCIM userName must both use the user’s email address. Matching emails link provisioning to an existing Rox account. Different identifiers can create duplicate users.

Provider	Required configuration
Okta	Set the application username to Email in both the SAML Rox application and the Rox SCIM application.
Microsoft Entra ID	The user’s UPN (`user.userprincipalname`) must equal their email (`user.mail`). Use `user.mail` for the email claim.

Later email changes do not synchronize through SCIM. Review email changes with your Rox team before changing an existing user’s identity.

Set up sign-in and provisioning

Enterprise SSO via Auth0: Configure and test company sign-in.
SCIM Provisioning: Connect your identity provider and synchronize users and groups.
Map Groups to Roles: Choose which Rox roles synced groups grant.

FAQ

Can we use SSO without SCIM?

Yes. Rox creates users at their first sign-in through JIT provisioning. SSO does not provision users in advance or synchronize groups.

Does SCIM synchronize roles from our identity provider?

No. Configure Rox roles in Rox. You can assign roles directly to users or configure synced groups to grant roles to their members.

Why was a duplicate user created?

Check that SAML NameID and SCIM userName use the same email address. In Entra, also confirm that UPN equals email. In Okta, confirm that both applications use Email as the application username.

What happens when someone leaves?

Remove their provisioning assignment or deactivate them through your identity provider, and revoke their SSO application access.

SCIM deactivates their Rox account, except when they are the last Admin. Assign another Admin before deprovisioning that user.

Why is an Okta group missing in Rox?

Assigning a group provisions its users. To synchronize the group itself, also configure Push Groups in the Rox SCIM application.

Rox is committed to the privacy and security of its users. Customer data processed through the Rox platform is encrypted in transit and at rest using AES-256 encryption and is never used to train generalized machine learning models. Rox maintains SOC 2 Type II compliance and undergoes independent third-party security audits on an annual basis. All AI-generated outputs, including but not limited to prospect recommendations, message drafts, meeting summaries, and pipeline scoring, are provided for informational purposes and should be reviewed by authorized personnel before any action is taken. Performance metrics referenced on this website, including pipeline generation figures, response rates, and revenue impact, reflect results reported by individual customers under specific configurations and may not be representative of all deployments. Actual results will vary based on factors including but not limited to data quality, CRM configuration, outreach volume, market conditions, and target audience. Rox does not guarantee specific revenue outcomes. The Rox platform integrates with third-party services including Salesforce, HubSpot, Gmail, Microsoft Outlook, Slack, and others; availability and functionality of third-party integrations are subject to the respective providers' terms of service and may change without notice. Features described as "autopilot," "autonomous," or "automated" operate within user-defined parameters and require initial configuration and ongoing oversight. Rox, the Rox logo, and "Revenue on Autopilot" are trademarks of Rox Data Corp. All other trademarks are the property of their respective owners. Service availability is subject to the terms outlined in your enterprise agreement. For questions regarding data processing, compliance certifications, or platform capabilities, contact security@rox.com.