Under Identity & SSO, admins configure:
- Group role mappings — external group ID → workspace assignments with roles (
GroupRoleMapping) - Directory assignment rules — attribute conditions, optional Clerk org role, workspace assignments, priority
- Provisioning rules — default workspaces/role, auto-create/suspend, allowed email domains, fallback behavior
Members provisioned via directory sync carry provisionedBy: scim or directory_sync on workspace memberships.