These instructions outline the necessary steps to switch from a previous SSO setup with JIT group synchronization to SCIM user provisioning. If your previous SSO setup was for Entra ID, see this article for more information.
Prerequisites
- Admin access to DeepL
- Single sign-on with JIT group synchronization and groups, were previously setup
Backup your JIT group user assignments
If you are currently using Just-In-Time (JIT) group provisioning, we suggest backing up your group assignments before starting the configuration. These assignments were made during the JIT group synchronization setup.
- Go to the Users tab of your DeepL admin account
- Click Export all users
A list of all users and their current group assignments is exported
Delete JIT groups and disable JIT group synchronization
When you begin the SCIM provisioning process and a JIT group in DeepL has the same ID as a group that was provisioned via SCIM, the SCIM-provisioned group will overwrite the JIT group. This is the intended behavior, which allows you to manage the group from your Identity Provider (IdP).
However, if a JIT group is not in scope for SCIM provisioning, meaning it will not be assigned to the DeepL application in your IdP, that JIT group will not be overwritten. It will persist in your DeepL admin account even though it is no longer managed by your IdP. This can cause confusion when managing group assignments.
Therefore, to ensure that all your groups are managed solely by SCIM, we recommend deleting all previously created JIT groups.
As you delete JIT groups, your users may temporarily lose access to DeepL. Since they are being removed from groups associated with specific subscriptions or products, they will temporarily only belong to the default group. While their current SSO session may remain valid, they will only have access to products and subscriptions linked to the default group.
To minimize the impact on users, we recommend the following:
- Set your DeepL default group to a basic subscription to grant users continued access to core products during this brief configuration period.
- Notify your users in advance that they may experience a temporary loss of access while you perform maintenance on the application setup.
To delete groups, follow these instructions:
- Go to Groups in your DeepL admin account
- Click
next to the group your want to delete
- Select Delete group
To disable the JIT group synchronization follow, these instructions:
- Go to Settings in your DeepL admin account
- In section Team and Single sign-on click Edit next to the SSO configuration
- Uncheck JIT Group Sync, to disable JIT group synchronization