Identity and Access Management

Employee identity, group membership, SSO into applications, and — in enterprises — provisioning and offboarding.

Directory and SSO keep the official record of who works at the company. The Forge relies on that record so onboarding and offboarding don't have to be repeated in every app.

• User identities and group memberships
• SSO session events
• Deactivation and role-change events

• Provisioning of Forge access when a new employee is created
• Role assignment aligned to a directory group
• Deprovisioning of Forge access when a directory user is deactivated

• Directory user created
• Directory user deactivated
• Group membership changed

• Manually creating Forge users when someone joins
• Forgetting to remove Forge access when someone leaves
• Maintaining per-app role mappings by hand

• Information technology or technical administrator
• Owner / executive
• Workforce, HR, or payroll administrator

• Access reviews scoped to the current directory state
• Orphaned accounts (users active in an app but inactive in the directory)

• Uses standards-based SSO (OIDC / SAML) where the provider supports it.
• Directory group → Forge role mapping is explicit and auditable.

• Small businesses may not have a directory — direct Forge accounts remain the primary path there.

The Forge is not a directory. It uses one when it exists.