Manage user access in SSO organizations

​

Settings

​

JIT provisioning

​

Invites

​

Update settings

curl -X PATCH https://api.smith.langchain.com/api/v1/organizations/current/info \
  -H "Authorization: Bearer $LANGSMITH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jit_provisioning_enabled": true,
    "invites_enabled": true
  }'

{
  "id": "org-uuid",
  "display_name": "My Organization",
  "jit_provisioning_enabled": true,
  "invites_enabled": true,
  "sso_login_slug": "my-org",
  ...
}

​

How user access works

1. User authenticates with SSO provider.
2. LangSmith checks if user already has organization access:
   Copy

   ├─ YES → User is signed in
   └─ NO → Continue to step 3
   
3. Check if invites are enabled and a pending invite exists:
   Copy

   ├─ YES → Provision into organization with invite's organization role; provision into workspaces if invite included workspaces
   └─ NO → Continue to step 4
   
4. Check if JIT provisioning is enabled:
   Copy

   ├─ YES → Automatically provision user with default SSO workspaces/role
   └─ NO → Deny access (user must be added via SCIM or by administrator)
   

​

Configuration scenarios

​

Open access (both enabled)

• ✓ JIT Provisioning enabled
• ✓ Invites enabled

• Users can sign in immediately via SSO and are auto-provisioned.
• Admins can send invites to assign specific roles or workspaces.
• Invited users get the invite configuration; non-invited users get default SSO configuration.

User alex@company.com signs in via SSO:
  - No invite exists → Added to default workspaces with Viewer role

User billy@company.com signs in via SSO:
  - Invite exists for Editor role in "Production" workspace → Added only to "Production" workspace with Editor role (invite takes precedence)

​

JIT only (invites disabled)

• ✓ JIT Provisioning enabled
• ✗ Invites disabled

• All users who authenticate via SSO are automatically provisioned.
• Admins cannot send invitations.
• All new users receive the same default workspaces and role.

​

Invite only (JIT disabled)

• ✗ JIT Provisioning disabled
• ✓ Invites enabled

• Users must be invited before they can access the organization.
• Users without invites are denied access even with valid SSO credentials.
• Fine-grained control over who can access the organization.

User alex@company.com signs in via SSO:
  - Has pending invite → Successfully joins organization

User billy@company.com signs in via SSO:
  - No invite → Access denied (must request invite from administrator)

​

Closed access (both disabled)

• ✗ JIT Provisioning disabled
• ✗ Invites disabled

• SSO users cannot join the organization automatically.
• Invitations cannot be sent.
• Users must be provisioned through SCIM or directly by an administrator once they are already part of the organization via SCIM.

​

User access quick reference

​

Configure default SSO settings

1. Default workspace role. Choose the workspace role that users receive when automatically provisioned. For details on what each role can do, refer to Organization and workspace operations. Options include:
   • Viewer: Read-only access
   • User: Standard access
   • Editor: Can modify resources
   • Admin: Full workspace control
2. Default workspaces. Select one or more workspaces that users are automatically added to. Users receive the same role in all selected workspaces. To configure:
   1. Go to Settings → Organization → SSO Configuration.
   2. Set Default workspace role.
   3. Select Default workspaces.
   4. Save your configuration.

​

SCIM integration

​

Related documentation

• Set up SSO with OAuth2.0 and OIDC (Self-hosted)
• Set up SAML SSO (Cloud)
• Set up SCIM
• User management
• Role-based access control