Skip to main content
Single sign-on (SSO) and Directory Sync are optional for getting started. You can invite operators, create Flow teams, and let people request help through a connected Slack workspace or Microsoft Teams tenant without either. Directory Sync adds information about your people that Flow can use in responses and automations. It also enables directory-based email intake and team membership. SSO controls work-account sign-in. Directory Sync supplies people, groups, and profile updates. SSO alone does not provide group synchronization, directory-based email intake, or ongoing directory profile updates.

​
When to connect Directory Sync

Start without Directory Sync if you want to test chat requests with manually managed team members. Connect it when your service needs employee context, manager approvals, group-based access, or email from new requesters. Skipping it reduces setup, but leaves Flow with less information and more access management for administrators. You can still use connected knowledge sources and automations that do not depend on directory data. Their required connections, team capabilities, and permissions still apply.

​
What information Flow can use

Available fields depend on what your provider sends and how its attributes are mapped. Flow uses the data in different ways:
  • Conversation context: department, job title, time zone, manager name, and location. Location uses the office location when available, otherwise the city or region.
  • Manager Approval: the manager’s email or directory manager ID must resolve to one active organization user who is eligible to approve. A manager name alone is not enough.
  • Custom approval evaluators: API-managed approval procedures can evaluate profile values such as department, job title, organization name, country, region, city, employee number, and cost center. These fields are not all included in conversation context. Syncing them does not create approval rules or change standard procedures automatically.
Other supported fields, such as locale (language preference), can be stored on the profile without being included in conversation context. Connecting a directory does not guarantee that every field is present or make arbitrary custom attributes available to Flow. For example, in a laptop replacement request, location can help Flow give relevant instructions, and a synced manager relationship can route Manager Approval. Without those details, Flow has less context, and that approval procedure cannot resolve a missing manager. Supplying a name in chat does not establish an authorized approver. Assigned laptops and other devices come from asset connections, not Directory Sync alone. Knowledge content and automation actions also need their respective connections. A provider’s directory connection does not replace its asset or knowledge connections. An automation must still obtain its required inputs and enforce its approval policy; Directory Sync does not populate every automation input automatically.

​
Keeping the directory useful

Directory Sync shares more employee information with Flow and adds a connection to maintain. Choose the users, groups, and supported attributes your service needs in the provider’s sync configuration. People and attributes outside that scope are not available through Directory Sync. Keep manager relationships and access groups current, monitor sync health, and test with a requester whose profile includes the fields your service needs. Syncing directory records does not mean creating a Flow account for everyone. Ordinary requesters are enrolled when needed. Explicit group-to-team mappings enroll their members in advance because you have chosen to grant them a team role.

​
Review identity settings

1

Open Identity settings.

Open Settings → Identity.
2

Check domain verification.

Confirm your organization’s email domain under Domain verification.
3

Review Single Sign-On.

Check sign-in readiness with a work account under Single Sign-On.
4

Review Directory Sync.

Check the employee context and the directory profiles, groups, and mapped team membership Directory Sync keeps current.
Verify the domain before configuring single sign-on or directory sync.

​
Set up identity

1

Open Identity settings.

Open Settings → Identity.
2

Verify the domain.

Select Verify domain and complete the steps shown.
3

Set up SSO and directory sync.

Set up single sign-on and directory sync as needed.
4

Refresh status.

Return to Flow and select Refresh status.
5

Review the status.

Review the status before assigning group-based team roles.
Directory sync keeps profiles and groups current. It does not grant browser access or roles by itself. By default, directory sync does not create Flow user accounts in bulk. People in your connected Slack workspace or Microsoft Teams tenant can ask for help without signing in to the web app. Flow creates their requester accounts when they first contact it. This does not grant browser login, a team role, or organization administrator access.

​
Restricting chat to directory users

Open Settings → Identity → Advanced identity settings and turn on Require IdP-verified identities to require an active synced directory identity for Slack and Microsoft Teams access. This includes existing requesters, invited operators, and administrators when they use those channels. Leave it off to accept verified members of your connected workplace without requiring directory enrollment first. Flow verifies the sender through Slack or Microsoft Teams. It does not trust a display name or an email typed into a message, and it does not restore access that an administrator has revoked.

​
Email and directory lookups

For directory-based email intake and manager approvals, Flow looks up and enrolls the eligible person when needed. Directory updates keep existing profiles current without creating accounts for everyone in the directory. Email from new requesters requires Directory Sync. Invited members with a known email can use email without it. Email authentication is always required; joining through Slack or Teams alone does not enable email access. Use Settings → Users for organization roles. Use Settings → Flow Teams for direct membership and directory group mappings.

​
Choosing a default team

Choose a team that Flow adds directory users to the first time they sign in through the browser.
1

Open Member access.

Open Settings → Identity → Member access.
2

Turn on the default team.

Select Add members to a default team on first browser login.
3

Choose a team and a role.

In Default team, select an active team. In Team role, select the role.
4

Save the settings.

Select Save.
Flow adds eligible directory-policy members on their first browser sign-in. New workspaces start with Flow Admin and Agent selected. The founding administrator joins Flow Admin as Manager. Clear the checkbox to let future directory-policy members sign in without an automatic team role. The Team and Role pickers disappear. Flow retains your selection for later use. Changes do not move existing members or change their roles. People who already signed in, joined by invitation, or joined through a team group mapping do not receive this assignment. People who existed before this feature became available also keep their current access. Slack, email, and Microsoft Teams first-contact behavior stays the same. A person admitted through the directory policy in one of these channels can receive the assignment when they first sign in through the browser. An existing direct or group role takes precedence, even when it grants less access. Directory offboarding removes the automatic assignment. A role that an administrator explicitly assigns remains under that administrator’s control.

​
Syncing a group to a Flow team

Map a directory group to a role when you want Flow to maintain that team’s membership automatically.
1

Connect Directory Sync.

Confirm it has active groups available. SSO alone does not provide group membership.
2

Open the team's directory groups.

Open Settings → Flow Teams and expand the team. Then open the Directory groups tab. While you create a team, this is under Members → Directory groups.
3

Select a directory group.

In Directory group, search for a synced group and select it.
4

Select a team role.

In Team role, select the role the group grants.
5

Add the mapping.

Select Add.
If Directory groups shows Requires Directory Sync, group mapping is unavailable. Organization administrators can select Set up to open Identity settings in a new tab. You can continue with manual members or invitations in the meantime. Flow enrolls the group’s existing members in the background and adds new members as directory updates arrive. They do not need to message Flow first. This explicit mapping works independently of the default first-contact enrollment policy. When someone leaves the group, Flow removes the access granted by that mapping. Direct team assignments and other group mappings still apply. Disabling a mapping removes its team role. If that mapping was the person’s only access, Flow also removes its directory-managed organization membership. People who have already used connected chat retain requester access, but not the removed team role. Flow does not delete their account. Disabling the directory user still revokes directory-managed access. Restoring a deleted Flow team also resumes its group mappings and adds members who joined while the team was deleted. If a group has not been observed for 30 days, Flow requires a directory refresh before granting mapped access. An unchanged group can reach this limit even when the directory is connected. Refresh directory sync if the mapping shows Attention needed. Only mapped groups are enrolled in advance. Other eligible people remain on-demand. A mapping does not create a sign-in account or grant organization administrator access. Its team role determines what the person can access after they sign in.

​
Enroll a member

When Member access is Invite-only or Specific directory groups, you can still enroll one directory user that policy does not cover. The person must be an active user in your connected directory. Your enrollment is the authorization, so the access policy does not apply to it.
1

Open Identity settings.

Open Settings → Identity.
2

Enter their work email.

Enter their work email under Enroll a member.
3

Send the invitation.

Select Send invitation.
4

Check the invitation.

Check Settings → Users → Invitations.
Flow sends the person an invitation. They accept it and sign in with your identity provider. The person still needs the appropriate organization and team roles.