# Identity

> Federate sign-in with your identity provider, then let it manage Cephable membership automatically.

Source: https://help.cephable.com/docs/it-admins/identity

---

Two pieces, in this order.

**Single sign-on** federates authentication: your users sign in with your identity provider
instead of a Cephable password, on every client. **SCIM** then lets that same provider manage
who is a member, so a leaver's seat is freed as part of offboarding rather than as a task
somebody has to remember.

SSO comes first — SCIM assumes federated identity.

:::callout type="important" title="Both are set up with Cephable, not in the Portal"
Neither of these is a self-serve page of fields. Cephable configures them for your
organization in partnership with your IT team, through a short exchange of identity-provider
details. The pages below document how each works and exactly what you will be asked for, so
you can have it ready.

Start either one — or request a change to an existing configuration — by emailing
[support@cephable.com](mailto:support@cephable.com).
:::

:::callout type="warning" title="Start before the pilot"
Domain verification is what routes work email addresses to your identity provider, and it is
part of the SSO setup rather than something you do separately. Doing it after people have
created personal Cephable accounts means merging accounts later — so open the thread with
support early enough that the exchange finishes before your pilot starts.
:::