A short checklist to get your team provisioned cleanly from your identity provider (Microsoft Entra, Okta, or similar). Working through it before you turn provisioning on means your people land in the right place from the first sync — with no clean-up afterwards.
Three decisions that save the most time later.
Provisioning brings in everyone in the groups you assign — so scope those groups to the people who will use OKRs Tool, not your whole directory. Leave out shared mailboxes, meeting rooms, point-of-sale and service accounts, and duplicate or external (ext_) logins. Trimming the group is the single thing that prevents a messy first sync.
Agree the expected user count with us up front. It sets your plan and keeps the first sync in line with what you planned for. If the number grows, that's fine — just let us know so we're set up for it.
If you run a group of companies or regions, decide the list (for example Sweden, Norway, Denmark). You'll have one identity-provider group per company or region, and we link each one to its place in OKRs Tool. For a single company, one group is enough.
What your IT team does in your identity provider.
Create a single OKRs Tool enterprise application in your identity provider and assign the groups you scoped in step 1. Users-only provisioning is the simplest start; you can add group provisioning later.
Your group names can follow your own convention — they don't need to match the company or region names. Send us each group's Object ID (the stable identifier) alongside the name. We link by ID, so a later rename never breaks the connection.
Once we've mapped your groups to their companies or regions, you turn provisioning on. People then land in the right place from the first sync — no manual placement, no clean-up.
Keep roll-out mode on while you're setting up. It holds all invitation emails so you can add everyone quietly. If it's switched off before the groups are trimmed, invitations go to every provisioned account — including any mailboxes or rooms still in the group. Clean the groups first, then release invitations.
A few things about how provisioning behaves, so nothing is a surprise.
Identity providers sync in cycles, roughly every 40 minutes, so a large team trickles in rather than appearing at once. A brand-new person has broad access for that short window, then settles into their company or region once their group syncs.
Once your SSO connection is set up and tested, turn on Require SSO in Settings → Security. That sends everyone to your identity provider to sign in. Make sure everyone is assigned to the OKRs Tool app first, so no one is locked out.
When you remove a person from a company or region group, they lose access to it on the next sync. Anyone you've added to extra companies or regions by hand stays — manual assignments aren't touched.
Send your group names and Object IDs, and we'll have the links in place before you switch provisioning on — and stay on hand through the first regions going live.
OKRs Tool · Enterprise onboarding · SCIM & SSO