What these systems normally control
Requirements for assessment; confirm supported actions before relying on this workflow.
Employee identity, group membership, SSO into applications, and — in enterprises — provisioning and offboarding.
Identity and Access Management
Keep account access aligned with each person’s responsibilities.
Provider options and connection limits
Providers to assess for identity and access management
Google WorkspaceNeeds assessment
Microsoft Entra IDNeeds assessment
OktaNeeds assessment
Auth0Needs assessment
Check the actual connection before changing your process.
On Pro, the QuickBooks Online connection imports customers and invoices from your own company and does not write back. It still needs checking with your company. Other provider names and the information flows below describe requirements to assess, not ready-to-use connections. Confirm the provider, plan, permissions, direction and any setup cost before work begins.
Why the specialized system usually stays
Requirements for assessment; confirm supported actions before relying on this workflow.
Directory and SSO keep the official record of who works at the company. The Forge relies on that record so onboarding and offboarding don't have to be repeated in every app.
Information to review for import
Requirements for assessment; confirm supported actions before relying on this workflow.
- User identities and group memberships
- SSO session events
- Deactivation and role-change events
Information to review for export
Requirements for assessment; confirm supported actions before relying on this workflow.
- Provisioning of Forge access when a new employee is created
- Role assignment aligned to a directory group
- Deprovisioning of Forge access when a directory user is deactivated
Events to consider during setup
Requirements for assessment; confirm supported actions before relying on this workflow.
- Directory user created
- Directory user deactivated
- Group membership changed
Manual work the proposed connection may reduce
Requirements for assessment; confirm supported actions before relying on this workflow.
- Manually creating Forge users when someone joins
- Forgetting to remove Forge access when someone leaves
- Maintaining per-app role mappings by hand
Whose work improves
Requirements for assessment; confirm supported actions before relying on this workflow.
- Information technology or technical administrator
- Owner / executive
- Workforce, HR, or payroll administrator
Reports that become possible
Requirements for assessment; confirm supported actions before relying on this workflow.
- Access reviews scoped to the current directory state
- Orphaned accounts (users active in an app but inactive in the directory)
Access and permission notes
Requirements for assessment; confirm supported actions before relying on this workflow.
- Uses standards-based SSO (OIDC / SAML) where the provider supports it.
- Directory group → Forge role mapping is explicit and auditable.
Common category-wide limitations
Requirements for assessment; confirm supported actions before relying on this workflow.
- Small businesses may not have a directory — direct Forge accounts remain the primary path there.
What might be replaced after review
Requirements for assessment; confirm supported actions before relying on this workflow.
The Forge is not a directory. It uses one when it exists.