External Identity Providers
Introduction
SSO vs user provisioning—what each does and which guide to follow.
What This Section Is About
Many companies already have an identity provider (Microsoft Entra ID, Okta, and similar). Skillhabit can connect to that world in two different ways. Mixing them up is the most common setup mistake.
| User provisioning | SSO / authentication | |
|---|---|---|
| Question it answers | Who exists in Skillhabit? | How does someone sign in? |
| What it does | Creates, updates, and often archives users (and groups) from a directory or your own systems on a schedule or push | Lets people open Skillhabit with Login code / Magic Links, Microsoft, OpenID Connect, API login links, or (when enabled) SAML |
| What it does not do | Decide how the login screen works | Replace full directory sync (groups, leavers, ongoing profile updates) |
You often need both: provision people from Entra, SCIM, or the API when the directory should own lifecycle—and turn on the sign-in methods those people should use.
Sign-in can also create a first account in some cases (approved email domains for Login code / Magic Links / Microsoft, or OpenID Connect with auto-create). That is still not the same as syncing groups and leavers from your IdP.
Pick a Guide
- User Provisioning — Microsoft Entra ID sync, SCIM, External API user lifecycle, and attribute mappings onto Skillhabit attributes
- SSO and Authentication — Login code, Magic Links, Microsoft, OpenID Connect, External API login links, sessions, shared devices, and when first login creates an account
- Add Attributes to IdP Tokens and Profiles — Entra, Okta, Auth0, and SCIM: release department and other fields so mappings can work
Quick Examples
- “New hires should appear in Skillhabit automatically from Entra, including groups.” → Provisioning (Entra sync), then enable Microsoft sign-in under SSO.
- “Anyone on
@company.comshould get an account the first time they use email or Microsoft sign-in.” → Add the domain under Approved for Sign Up, enable the login method—see SSO and Authentication. - “Our portal creates users over HTTPS, then opens Skillhabit for them.” → Provisioning via the External API, then Create sign-in link under SSO / Authentication.
- “Department from Entra should fill a Skillhabit attribute.” → Map in Skillhabit (User Provisioning), and release the field from the IdP (Add Attributes to IdP Tokens and Profiles).
