Appearance
Accounts, roles and limits
Available onEnterprise
Who can do thisWorkspace owners and admins
Just-in-time accounts
Infyva creates accounts the first time someone signs in with SSO. You don't need to invite people first.
| Who signs in | What happens |
|---|---|
| A new person on a verified domain | Infyva creates an account in your workspace with the default role, marks the email as verified, and asks them to accept the Terms once. |
| A teammate who is already in your workspace | They sign straight in. Their role and history don't change. |
| Someone with an Infyva account that isn't in any workspace yet | They join your workspace with the default role. |
| Someone who belongs to a different Infyva workspace | Refused: This account belongs to a different workspace. |
| A suspended teammate | Refused: Your account is suspended. Contact your workspace admin. |
| A candidate account | Refused. Candidates never sign in with SSO. |
Team members are unlimited on every plan, so SSO sign-ups never run out of seats.
If an existing account's email address was never verified, the first SSO sign-in also replaces its password, ends its open sessions and clears its two-factor setup. The person can set a new password with Forgot password while SSO isn't required.
If someone on your verified domain tries the public sign-up form instead, Infyva doesn't create a separate workspace. It emails them a link to sign in with your company account. Invite links you send from Team and roles still work as usual.
Choose the default role
- In the sidebar, click Settings, then Single sign-on.
- Under New teammates join as, choose Recruiter or Viewer.
- Click Save.
Owners and admins can change this setting. It applies to people who join from then on. To give someone Admin, or to change anyone's role later, use Settings > Team and roles. See Roles and permissions.
When someone leaves
Infyva does not get user changes from your identity provider. When someone leaves:
- Remove or block them in your identity provider. They can no longer start an SSO sign-in.
- In Infyva, open Settings > Team and roles, open the menu next to the person, and choose Suspend account. Their jobs and reports stay with the workspace.
Do both. Step 1 alone does not end a session that is already open. Use Suspend account rather than Remove: a removed person who can still sign in at your identity provider joins the workspace again, with the default role, the next time they sign in with SSO. A suspended person is refused.
Limits in this release
- No SCIM provisioning. Users and groups are not pushed from your provider, and nobody is removed automatically. Plan to deprovision in Infyva by hand, as above.
- No group or role mapping. One default role applies to everyone who joins through SSO.
- Sign-in starts from Infyva. Sign-in started from your provider's app launcher tile is not supported. Point the tile at
https://www.infyva.ai/auth/login, or hide it. - One identity provider per workspace.
- No single logout. Signing out of Infyva doesn't sign you out of your provider, and the other way round.
- No automatic certificate refresh. After you rotate your provider's signing certificate, save the connection in Infyva again.
- Team members only. Candidates and hiring managers using review links don't need accounts. If you turn on Require SSO on hiring-manager links, hiring managers sign in with SSO and join the workspace with the default role.