Availability of administrative controls is confirmed during rollout. Your agreement with Almanac governs the features available to your organization.
Directory sync makes your organization’s directory the source of truth for Almanac access. Adding someone to a selected group provisions their account. Removing them removes access.
Choose a directory provider
Almanac supports Okta, Microsoft Entra ID, Google Workspace, Workday, and other directories that support SCIM.
Confirm your provider during rollout. Setup steps and available attributes vary by directory.
Directory sync provisions accounts. Single sign-on authenticates them. Most organizations use both. See Authentication.
Connect your directory
- Ask the Almanac team to create your organization and provide a setup link.
- Verify your domain using the DNS record shown during setup.
- Choose your directory provider and complete its connection steps.
- Select the groups that should have access.
- Review how names, email addresses, and other attributes map to Almanac.
A setup link remains valid for 30 days and closes after setup is complete. Request another link if it expires or you need to reconnect your directory.
Choose which groups have access
Only members of the groups you select are provisioned in Almanac. Use groups created specifically for Almanac when you want access changes to remain deliberate and easy to review.
You can change the selected groups later.
Adding a group provisions everyone in it. Before syncing a large group, confirm that your organization has the appropriate licenses and managed settings.
Assign roles from groups
You can map a directory group to an Almanac role. Members of that group receive the mapped role automatically.
Keep groups mapped to the administrator role limited and regularly reviewed. If a member belongs to several mapped groups, the highest-priority role applies.
Group-based role assignment requires a SCIM directory or Google Workspace. See Roles and access.
Remove access
Removing a member from a synced group or deactivating them in your directory removes their access to Almanac.
Sessions end at the next refresh. Contact Almanac when you need to revoke active sessions immediately.
Before enabling directory sync, decide what should happen to conversations and files belonging to a member who leaves. See Roles and access.
Decide before rollout
Choose:
- Your directory provider and its administrator.
- The groups that grant access.
- Any group that grants administrator access.
- What happens to a departing member’s work.
- Who can request an urgent session revocation.