> ## Documentation Index
> Fetch the complete documentation index at: https://ona.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrict account creation to SCIM

> Restrict organization access to users provisioned via SCIM.

> [!NOTE]
>
> Available on the Enterprise plan. [Contact sales](https://ona.com/contact/sales) to learn more.

When enabled, only users provisioned via [SCIM](https://ona.com/docs/ona/scim/overview.md) can access the organization. Users attempting to sign in via SSO without a SCIM-provisioned account are blocked.

Useful when:

* Centralizing account lifecycle management in your identity provider
* Ensuring every user in the organization has a corresponding directory entry
* Preventing access from users outside your provisioned scope, even if they can authenticate via SSO

## Prerequisites

* An active [SSO login provider](https://ona.com/docs/ona/sso/overview.md)
* An enabled [SCIM configuration](https://ona.com/docs/ona/scim/overview.md) linked to that SSO provider

The toggle is disabled until SCIM provisioning is configured and enabled.

## Configuration

1. Go to **Settings → Organization → Policies**
2. Toggle **Restrict Account Creation to SCIM**

Changes take effect immediately for new sign-in attempts. Existing members are not removed.

## Effect on users

| User type | Behavior |
| - | - |
| SCIM-provisioned users | Sign in normally via the linked SSO provider |
| Non-provisioned users (SSO only) | Blocked from creating an account or joining the organization |
| Existing members | Retain access; remove via your IdP or by deactivating the user |

> [!WARNING]
>
> Before enabling, confirm that all users who need access are in scope of your SCIM provisioning. Users outside the provisioning scope will lose the ability to sign in to a new account, even with valid SSO credentials.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.