> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyperline.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on and user provisioning

> Connect Google Workspace to Hyperline for enterprise single sign-on, automatic user provisioning, and group-based role assignment via SCIM.

Connect Google Workspace to let members sign in through your identity provider and automatically keep access to your Hyperline account in sync with your directory.

Enterprise SSO is available on demand and currently supports Google Workspace. The account owner configures the connection separately for each Hyperline account.

## Connect Google Workspace

<Steps>
  <Step title="Navigate to Settings > General" />

  <Step title="Click Set up in the Single sign-on section" />

  <Step title="Complete the Google Workspace setup assistant">
    Configure single sign-on, verify your domain, and authorize Directory Sync.
  </Step>

  <Step title="Return to Hyperline">
    Hyperline displays the connection and its configuration statuses.
  </Step>
</Steps>

The two statuses describe separate parts of the connection:

| Status             | Meaning                                                                                |
| ------------------ | -------------------------------------------------------------------------------------- |
| **SSO**            | Members can sign in to Hyperline through Google Workspace                              |
| **Directory Sync** | Hyperline can create, update, and remove account memberships based on Google Workspace |

<Note>
  An SSO connection can be active while Directory Sync is not configured. The
  **User provisioning** switch controls whether Hyperline applies directory
  changes; it does not confirm that Directory Sync is configured in Google
  Workspace.
</Note>

## Reconfigure the connection

If a setup step was skipped or failed, click **Reconfigure** next to the connection. Hyperline opens a new setup assistant for the existing connection so that you can complete SSO, domain verification, or Directory Sync without starting over.

## Manage user provisioning

When **User provisioning** is enabled, Hyperline synchronizes members from the connected Google Workspace directory:

* A new directory user creates a Hyperline member for this account.
* If the email address already belongs to a Hyperline user, Hyperline links the existing user instead of creating a duplicate.
* Directory profile and group changes update the linked member.
* Removing a provisioned user from the directory removes their provisioned access to this Hyperline account. Access to other Hyperline accounts remains unchanged.
* Account owners are never automatically removed by Directory Sync.

You can still invite and manage members manually. Hyperline identifies provisioned memberships separately because their access and role are managed by the identity provider.

## Map Google groups to roles

Use group role mappings to control the role assigned to provisioned members.

<Steps>
  <Step title="Navigate to Settings > Members > Roles" />

  <Step title="Choose a default role">
    Hyperline assigns this role when none of the member's Google groups matches a mapping. A default role is required before user provisioning can be enabled.
  </Step>

  <Step title="Click Add mapping" />

  <Step title="Select a Google group and a Hyperline role, then save" />
</Steps>

If several mappings match a member, the first matching group determines their role. Changing the default role or a group mapping automatically reconciles provisioned memberships.

Roles for provisioned members are controlled by these mappings and cannot be changed directly from the member list.

## Related

* [Users & permissions](./users-permissions)
* [Account settings](./settings)