> ## Documentation Index > Fetch the complete documentation index at: https://docs.letsflow.ai/llms.txt > Use this file to discover all available pages before exploring further. # Identity and directory > Choose how people request help, sign in, and receive directory-based access. Single sign-on (SSO) and Directory Sync are optional for getting started. You can invite operators, create Flow teams, and let people request help through a connected Slack workspace or Microsoft Teams tenant without either. Directory Sync adds information about your people that Flow can use in responses and automations. It also enables directory-based email intake and team membership. SSO controls work-account sign-in. Directory Sync supplies people, groups, and profile updates. SSO alone does not provide group synchronization, directory-based email intake, or ongoing directory profile updates. ## When to connect Directory Sync Start without Directory Sync if you want to test chat requests with manually managed team members. Connect it when your service needs employee context, manager approvals, group-based access, or email from new requesters. Skipping it reduces setup, but leaves Flow with less information and more access management for administrators. You can still use connected knowledge sources and automations that do not depend on directory data. Their required connections, team capabilities, and permissions still apply. | Capability | Without Directory Sync | With Directory Sync | | - | - | - | | **Relevant responses** | Flow uses the identity information it already has, the request, and other connected sources. It may need to ask for missing details. | Synced department, job title, location, time zone, and manager information can give Flow more context. | | **Manager Approval** | A request cannot use this procedure unless Flow can resolve the requested-for person's manager. Use another configured approval procedure if that relationship is unavailable. | A synced manager relationship lets Flow resolve the approver. The manager must still be eligible to approve. | | **Email from new requesters** | Limited to invited Flow members with a known email. Email authentication still applies. | Eligible directory users can start requests by email without a browser invitation. | | **Group-based team roles** | Assign and remove team members manually. | Map a directory group to a Flow team role. Flow maintains membership as people join or leave the group. | | **Employee changes** | Manage access in Flow and the connected chat provider. Directory changes are not synchronized. | Profile updates and user status changes update directory-managed profiles and access. Independent access grants still need review. | ### What information Flow can use Available fields depend on what your provider sends and how its attributes are mapped. Flow uses the data in different ways: * **Conversation context:** department, job title, time zone, manager name, and location. Location uses the office location when available, otherwise the city or region. * **Manager Approval:** the manager's email or directory manager ID must resolve to one active organization user who is eligible to approve. A manager name alone is not enough. * **Custom approval evaluators:** API-managed [approval procedures](/automations/build/inputs-and-approvals#approvals) can evaluate profile values such as department, job title, organization name, country, region, city, employee number, and cost center. These fields are not all included in conversation context. Syncing them does not create approval rules or change standard procedures automatically. Other supported fields, such as locale (language preference), can be stored on the profile without being included in conversation context. Connecting a directory does not guarantee that every field is present or make arbitrary custom attributes available to Flow. For example, in a laptop replacement request, location can help Flow give relevant instructions, and a synced manager relationship can route **Manager Approval**. Without those details, Flow has less context, and that approval procedure cannot resolve a missing manager. Supplying a name in chat does not establish an authorized approver. Assigned laptops and other devices come from [asset connections](/setup/assets), not Directory Sync alone. Knowledge content and automation actions also need their respective connections. A provider's directory connection does not replace its asset or knowledge connections. An automation must still obtain its required inputs and enforce its approval policy; Directory Sync does not populate every automation input automatically. ### Keeping the directory useful Directory Sync shares more employee information with Flow and adds a connection to maintain. Choose the users, groups, and supported attributes your service needs in the provider's sync configuration. People and attributes outside that scope are not available through Directory Sync. Keep manager relationships and access groups current, monitor sync health, and test with a requester whose profile includes the fields your service needs. Syncing directory records does not mean creating a Flow account for everyone. Ordinary requesters are enrolled when needed. Explicit [group-to-team mappings](#syncing-a-group-to-a-flow-team) enroll their members in advance because you have chosen to grant them a team role. ## Review identity settings Open **Settings → Identity**. Confirm your organization's email domain under **Domain verification**. Check sign-in readiness with a work account under **Single Sign-On**. Check the employee context and the directory profiles, groups, and mapped team membership Directory Sync keeps current. Verify the domain before configuring single sign-on or directory sync. ## Set up identity Open **Settings → Identity**. Select **Verify domain** and complete the steps shown. Set up single sign-on and directory sync as needed. Return to Flow and select **Refresh status**. Review the status before assigning group-based team roles. Directory sync keeps profiles and groups current. It does not grant browser access or roles by itself. By default, directory sync does not create Flow user accounts in bulk. People in your connected Slack workspace or Microsoft Teams tenant can ask for help without signing in to the web app. Flow creates their requester accounts when they first contact it. This does not grant browser login, a team role, or organization administrator access. ### Restricting chat to directory users Open **Settings → Identity → Advanced identity settings** and turn on **Require IdP-verified identities** to require an active synced directory identity for Slack and Microsoft Teams access. This includes existing requesters, invited operators, and administrators when they use those channels. Leave it off to accept verified members of your connected workplace without requiring directory enrollment first. Flow verifies the sender through Slack or Microsoft Teams. It does not trust a display name or an email typed into a message, and it does not restore access that an administrator has revoked. ### Email and directory lookups For directory-based email intake and manager approvals, Flow looks up and enrolls the eligible person when needed. Directory updates keep existing profiles current without creating accounts for everyone in the directory. Email from new requesters requires Directory Sync. Invited members with a known email can use email without it. Email authentication is always required; joining through Slack or Teams alone does not enable email access. Use **Settings → Users** for organization roles. Use **Settings → Flow Teams** for direct membership and directory group mappings. ## Choosing a default team Choose a team that Flow adds directory users to the first time they sign in through the browser. Open **Settings → Identity → Member access**. Select **Add members to a default team on first browser login**. In **Default team**, select an active team. In **Team role**, select the role. Select **Save**. Flow adds eligible directory-policy members on their first browser sign-in. New workspaces start with **Flow Admin** and **Agent** selected. The founding administrator joins Flow Admin as **Manager**. Clear the checkbox to let future directory-policy members sign in without an automatic team role. The Team and Role pickers disappear. Flow retains your selection for later use. Changes do not move existing members or change their roles. People who already signed in, joined by invitation, or joined through a team group mapping do not receive this assignment. People who existed before this feature became available also keep their current access. Slack, email, and Microsoft Teams first-contact behavior stays the same. A person admitted through the directory policy in one of these channels can receive the assignment when they first sign in through the browser. An existing direct or group role takes precedence, even when it grants less access. Directory offboarding removes the automatic assignment. A role that an administrator explicitly assigns remains under that administrator's control. ## Syncing a group to a Flow team Map a directory group to a role when you want Flow to maintain that team's membership automatically. Confirm it has active groups available. SSO alone does not provide group membership. Open **Settings → Flow Teams** and expand the team. Then open the **Directory groups** tab. While you create a team, this is under **Members → Directory groups**. In **Directory group**, search for a synced group and select it. In **Team role**, select the role the group grants. Select **Add**. If **Directory groups** shows **Requires Directory Sync**, group mapping is unavailable. Organization administrators can select **Set up** to open Identity settings in a new tab. You can continue with manual members or invitations in the meantime. Flow enrolls the group's existing members in the background and adds new members as directory updates arrive. They do not need to message Flow first. This explicit mapping works independently of the default first-contact enrollment policy. When someone leaves the group, Flow removes the access granted by that mapping. Direct team assignments and other group mappings still apply. Disabling a mapping removes its team role. If that mapping was the person's only access, Flow also removes its directory-managed organization membership. People who have already used connected chat retain requester access, but not the removed team role. Flow does not delete their account. Disabling the directory user still revokes directory-managed access. Restoring a deleted Flow team also resumes its group mappings and adds members who joined while the team was deleted. If a group has not been observed for 30 days, Flow requires a directory refresh before granting mapped access. An unchanged group can reach this limit even when the directory is connected. Refresh directory sync if the mapping shows **Attention needed**. Only mapped groups are enrolled in advance. Other eligible people remain on-demand. A mapping does not create a sign-in account or grant organization administrator access. Its team role determines what the person can access after they sign in. ## Enroll a member When **Member access** is **Invite-only** or **Specific directory groups**, you can still enroll one directory user that policy does not cover. The person must be an active user in your connected directory. Your enrollment is the authorization, so the access policy does not apply to it. Open **Settings → Identity**. Enter their work email under **Enroll a member**. Select **Send invitation**. Check **Settings → Users → Invitations**. Flow sends the person an invitation. They accept it and sign in with your identity provider. The person still needs the appropriate organization and team roles. ## Related topics * [Permissions](/setup/permissions) * [Teams](/setup/teams) * [Settings](/setup/settings) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.