---
title: Identity & Access
sidebar:
  label: Overview
description: Keep your user list and groups in sync with Google Workspace, Microsoft Entra ID, or Okta.
---

:::info
Identity & Access lives on the **Integrations** tab in **Hub**. The tab is visible but greyed out until the next console release; the steps on these pages describe that release.
:::

An **integration** connects Surface to another company service. The first section is **Identity & Access**: syncing users and groups from your identity provider so the console's Users page stays current.

Each app is a card under **Identity & Access** that reads **Configure** or **Connected**. Click a card to open its panel.

| App | How it works | Guide |
| --- | --- | --- |
| **Google Workspace** | You sign in to Google once. Surface then reads group membership on a schedule | [Connect Google Workspace](/surface/hub/identity-access/google-workspace) |
| **Microsoft Entra ID** | Entra pushes users and groups to Surface over SCIM | [Connect Entra ID or Okta](/surface/hub/identity-access/entra-okta) |
| **Okta** | Okta pushes users and groups to Surface over SCIM | [Connect Entra ID or Okta](/surface/hub/identity-access/entra-okta) |

SCIM is the standard identity providers use to push user lists to other services.

## Disconnecting

Open the card and click **Disconnect**, then confirm.

:::warning
Disconnecting removes the connection **and the users and groups it created**. Any token you pasted into Entra or Okta stops working. Reconnecting means running the setup again with a new token.
:::

## Single sign-on

Signing in to the console is email-first: a person types their work email and is sent to the right sign-in page. Setting up your company's SSO is done with SuperAlign during onboarding.