Vantage Workspace — Enterprise Admin (Sprint 9)

Identity Provider Configuration

Provider Tenant / Domain ID (Entra tenant GUID, Okta subdomain, etc.) Issuer URL (leave blank to auto-compute for Entra/Google) Client ID Client Secret Redirect URI (must match what you registered in the IdP) Scopes

Configured IdPs

Provider	Client ID	Redirect	Status

IdP Group → Role / Department Mappings

Lower priority number wins. Use glob patterns like Security-*. The catch-all * rule should always be last.

JIT Provisioning Defaults

Applied when no mapping rule matches.

Default Role Default Department Auto-provision new users on first SSO login

SCIM 2.0 Provisioning Tokens

Generate a bearer token to paste into your IdP's SCIM connector. Token is shown once — copy it immediately.

Label Expires in days (0 = never)

Active Tokens

Label	Prefix	Created	Last Used	Status

Active Sessions

User	Provider	IP	Created	Last Activity	MFA

MFA Enforcement Policy

Mode Enforce for roles (only applies if mode = Required) Grace period (days) to allow existing users to enrol