Skip to navigation

Get started

Connect your identity provider, map Groups to tools and models, then hand employees their connection details

Set up Workforce once, in order. Your identity provider stays the source of truth: add someone to a Group there and they get that Group’s tools and models.

Workforce is priced per seat. See the pricing page and Billing and usage.

Setup

1

Enable SCIM and set default access

In Provisioning → Sync in the Workforce dashboard:

  1. Generate a SCIM token and copy the base URL shown with it. See SCIM provisioning.
  2. Set Default access, what an employee can reach before joining a Group. Leave it empty for most organizations. See Groups and access.
2

Configure SCIM in your identity provider

  1. Enter the SCIM base URL and token in the Workforce SCIM application.
  2. Assign employees to the application.
  3. Push the Groups you will use for access.

Okta syncs in near real time. Azure AD defaults to an approximately 40-minute cycle.

3

Map Groups to tools and models

On Provisioning → Sync, use Edit access on a Group to set:

  • Dashboard role: what members can do in the Workforce dashboard
  • Tool access: no tools, every tool, or chosen Tool Packs and tools

On Provisioning → Groups, pick a Group and set:

  • Resources: routing policy, approved models, Connectors, Tool Packs, and skills
  • Budget: an optional spend cap, enforced before any vendor is called

An employee in more than one Group gets the most permissive access across them.

4

Hand employees their connection details

Tools need one MCP endpoint plus an SSO sign-in. Models need a Gateway base URL and key.

Send employees Connect employee AI clients, or deploy centrally with Roll out tools and Roll out models.

On first connect, employees sign in through your identity provider and see a consent screen listing their tools. A call to a tool outside their set fails and appears in Requests.

Common issues

SymptomFix
Employee in your identity provider but not in WorkforceSCIM sync hasn’t run yet. Check your provider’s provisioning log
Employee signs in but sees no toolsMap their Group in Provisioning → Sync → Edit access, or check Default access
403 mid-conversationThe tool is outside the employee’s set. The request is waiting in Requests
Token won’t refreshRefresh tokens are revoked on deprovisioning. Confirm the employee is active in your identity provider

Next: test what a Group can reach in the Playground.