Configuring Enterprise SSO & SCIM 2.0

Step-by-step instructions for IT administrators connecting Okta, Microsoft Entra ID (Azure AD), or PingFederate to Forge.

Access Enterprise Identity Settings

As an Owner or Claims Manager, navigate to Settings (/dashboard/settings) and scroll to Enterprise Identity & Provisioning.

Select Your IdP Preset & Corporate Domain

Choose your identity provider from the quick setup templates:

Okta (SAML 2.0)

Microsoft Entra ID

PingFederate

Enter your enterprise Corporate Email Domain (e.g., bechtel.com). This enables Forge's automatic domain discovery on the login screen.

Provide Identity Provider Metadata

Fill in your IdP's parameters from your corporate console:

IdP Issuer / Entity ID URL: e.g., http://www.okta.com/exk... or https://sts.windows.net/...
Single Sign-On Login URL: The entry point URL where users authenticate.
X.509 Certificate (PEM): The public signing certificate used to verify SAML assertions.

Copy Forge SP Endpoints into Your IdP

In your Okta or Azure AD Application settings, paste Forge's Service Provider endpoints:

Assertion Consumer Service (ACS) URLhttps://api.forge-cc.io/api/identity/sso/saml/acs/{configId}

Audience URI / SP Entity IDhttps://api.forge-cc.io/api/identity/sso/saml/metadata/{configId}

Enable SCIM 2.0 Directory Synchronization

To automate team onboarding, role mapping, and offboarding:

In your IdP Provisioning tab, set authentication to OAuth / Bearer Token.
Copy the SCIM 2.0 Base URL (.../api/scim/v2).
Reveal and copy your environment's high-entropy SCIM Bearer Token.
Test the connection and enable Create Users, Update User Attributes, and Deactivate Users.

Evidence Safety: When an employee is deactivated in your IdP, Forge marks their environment status as SUSPENDED rather than deleting the account, guaranteeing that all historical audit logs and Statement of Truth evidence remain permanently intact.