Do you support identity-provider-initiated sign-in?

Yes — the Memtro tile in somebody's Okta dashboard signs them in without them visiting Memtro first.

Feature

Single sign-on and provisioning, at every price

Most AI tools treat single sign-on as the thing that moves you to a custom contract. Memtro treats it as how an organisation of any size is supposed to work: point it at your Microsoft Entra ID, your Okta, or anything speaking OpenID Connect or SAML 2.0, verify the domains you own, and your directory decides who signs in and who still may. SCIM then handles the joiners, the leavers and the groups, so the member list is maintained by the system that already knows about them.

The problem

01Somebody leaves, HR disables them in Entra, and a month later they can still sign in — because the tool had its own passwords all along.
02Single sign-on exists, but a password works too, so it is a convenience rather than a control.
03A new starter waits on an admin noticing the ticket before they can ask the company anything.
04Your groups are maintained in one place and your tool's teams in another, and they drift within a fortnight.
05Security review asks for SAML, SCIM and an audit log, and the answer is a price increase.
06An offboarding checklist has a line for every tool, and the line for this one is somebody remembering.

How it works

OpenID Connect against your own tenant — Entra by directory ID, Okta by issuer, or any provider with a discovery document — and SAML 2.0 for the providers that do that instead.
Your email domains are verified by a DNS TXT record before your provider may sign anybody in at them, because a provider may speak for any address it owns.
One option makes it compulsory: no password, no Google, no GitHub for anybody at your domains. It is refused until the provider is complete and a domain is verified, so it cannot lock out an organisation that has half-configured it.
People can be created on their first sign-in, as users or as admins, so a joiner has access on their first morning without anybody being asked.
SCIM 2.0 for the rest: new members, renames, and your groups as teams. Somebody marked inactive is signed out everywhere and their keys stop working, while their membership, memory and teams stay exactly as they were.
What becomes of what a leaver alone knew is chosen in advance by a person — kept, handed to their team, handed to the organisation, or erased with a receipt — because a provisioning run has nobody in it to ask.
Every one of these is recorded in an audit log, with provisioning attributed to the provider rather than to whoever happened to be signing in.

Ask it like this

›Which of our people have signed in this week, and from where?
›Who was made an administrator last month, and by whom?
›Has everybody who left in the last quarter actually lost access?
›Which teams came from our directory and which were made here?

Setting it up

01Open Organisation → Identity and choose your provider: Entra, Okta, another OpenID Connect provider, or SAML.
02Paste what it asks for — a tenant ID or an issuer with a client ID and secret, or a sign-on URL, entity ID and certificate for SAML — and add Memtro's redirect URI at your end.
03Add the TXT record it shows you at _memtro.yourdomain.com, and press Verify.
04Sign out and try it: type an address at that domain and the sign-in page offers your provider.
05Tick “everybody here signs in this way” once it works.
06Create a provisioning token and give it to your identity provider's SCIM connector, pointed at /scim/v2.
07Choose what happens to a leaver's memory. The default keeps everything and loses nothing.

What it does not do

It governs people, not programs. An API key is a credential for something you wrote and is revoked on its own page or by suspending its owner — a directory has no opinion on it.
A pushed group becomes a team, and does not carry what that team is allowed to do. Your directory knows who is in Finance; what Finance may read stays with your admins, deliberately.
There are no certifications behind it yet. SOC 2 and ISO 27001 are not done, and the hosting is one country — if your review stops there, it stops there.
SCIM filters other than `attribute eq "value"`, bulk operations and sorting are refused rather than half-implemented, which is all either provider sends.
Fields Memtro does not hold — department, title, manager — are accepted and ignored rather than invented.

Questions

Is it an extra charge?+

No. Single sign-on, SCIM provisioning and the audit log are included at every size, from the $50 tier upwards. There is no enterprise plan that unlocks them.

Does it work with Entra and Okta?+

Both, and anything else speaking OpenID Connect or SAML 2.0. Entra takes a directory (tenant) ID; Okta takes your own issuer URL, so each customer's tenant is configured separately rather than everybody sharing one app.

Can somebody still use a password?+

Only until you make the provider compulsory. That option is the point of the feature rather than a detail of it: until it is on, removing somebody from your directory does not take away a password they already have.

What happens when our directory removes somebody?+

By default their access is withdrawn and everything else is kept — signed out everywhere, keys revoked, membership, memory and teams untouched, undone by your directory adding them back. If you would rather a removal also dealt with what they alone knew, you choose which of three things it does, in advance.

Can a provider sign in people at a domain that is not ours?+

No. An assertion is only believed about addresses at domains that provider has verified by DNS, because an identity provider can mint a valid, correctly signed assertion for any address at all. Without that check, configuring a provider would be a route to any account on the platform.