Manage Access to Mondoo - Overview

Mondoo gives you several ways to control who and what can access your organizations and spaces. Pick the ones that match how your team is set up:

• Manage team members: invite people, assign roles, and scope access to the organization or to specific spaces from Settings > Identity & Access.
• Manage access with OIDC group claims: automatically assign users to Mondoo teams based on the groups in their identity provider (Entra ID, Okta, or any OIDC IdP). Lightweight alternative to SCIM.
• Configure SAML single sign-on: let people sign in to an organization through your SAML 2.0 identity provider (Okta, Entra ID, Google Workspace, OneLogin, and others). Depends on your plan.
• Manage access with Microsoft Entra (SCIM): full SCIM 2.0 single sign-on and user provisioning with Entra ID.
• Manage access with Okta (SCIM): full SCIM 2.0 single sign-on and user provisioning with Okta.
• Grant non-human access: service accounts, API tokens, and workload identity federation (WIF) for services, scripts, and CI/CD.

Which method should I use?Copy Anchor Link

For people, the choice comes down to how your team is managed:

• Invite team members directly for small teams or one-off access.
• Turn on SAML single sign-on so people sign in through your identity provider. SSO handles sign-in only; you still grant access with roles or teams.
• Use OIDC group claims to assign Mondoo teams from your identity provider's groups, with no provisioning infrastructure to run.
• Use SCIM (Microsoft Entra or Okta) when you need full user provisioning and deprovisioning synced from your IdP.

For services, scripts, and automation, see Grant non-human access.