Directory Sync connects your organization's identity provider (Okta, Microsoft Entra ID, or any SCIM 2.0 directory) to Mindsmith, so people are added to and removed from your organization automatically as your directory changes.

Note: Directory Sync requires the Enterprise tier of Mindsmith and an organization Admin account. You will be asked to re-enter your password when enabling, rotating, or disabling the connection. Not on the Enterprise plan yet? Contact sales to upgrade.

Read "Choosing the default role" and "What Directory Sync does not do yet" before you configure anything. A couple of behaviors are much easier to plan around than to discover later.

The bearer token is shown exactly once. Copy both values before you close the dialog. If you lose the token there is no way to look it up - you have to rotate the connection, which issues a new pair and invalidates the old one.

The Base URL looks like this, with a connection identifier on the end:

Paste exactly what the dialog shows. The Base URL stays visible on the card afterwards, so only the token needs saving. EU-hosted organizations get an eu.mindsmith.ai URL instead - see Regions below.

Your identity provider authenticates to Mindsmith with the bearer token in the HTTP Authorization header. Mindsmith accepts the credential in that header only - never as a query parameter or in the request body.

Point it at the Base URL, send the token as Authorization: Bearer <token>, and use application/scim+json for request bodies. Mindsmith implements the standard /Users resource with the full verb set.

The Default role for new members setting on the Directory Sync card controls the role people get when the directory first provisions them.

Admins are never provisioned automatically. Granting administrator rights from an external directory is not something we do implicitly, so Admin is always assigned by hand inside Mindsmith.

A few things worth knowing about how the role is applied:

You can change the setting at any time without rotating the token.

Group events have no effect on Mindsmith roles today. Your identity provider will report group pushes as successful, but nothing changes in Mindsmith as a result.

Plan around it this way: use group assignment in your identity provider to control who is in scope for provisioning, and use the default role setting to control what role they get. Per-group role mapping is a planned follow-up.

Mindsmith never renames an existing account from a directory push. A person's email address is their login identity across every organization they belong to and their personal workspace, so a directory that merely references them cannot rewrite it.

If your identity provider pushes an email that differs from the linked Mindsmith account, we record the difference and keep using the existing address. It appears in your provisioning activity as "Email address doesn't match." If someone genuinely needs their Mindsmith email changed, contact support. The same applies to names - a person's name is set once, when Mindsmith first creates their account, and directory updates do not overwrite it.

Deactivating a person in your identity provider, or removing them from the app entirely, removes their access to your Mindsmith organization.

Removing someone from your directory removes them from your organization, not from Mindsmith - they are not signed out of other organizations or their personal workspace. If you need a global cutoff, contact support.

One case needs care on your side. If the person you deactivate is the last remaining administrator of the organization, Mindsmith carries it out rather than refusing, which would leave you with nobody able to manage members or the connection. You are not emailed when this happens. Before deactivating an administrator in your directory, promote someone else in Mindsmith first.

If someone was added by another route (an invite, or domain auto-join) rather than by the directory, deactivating them still removes them - but because we match them by email rather than a directory link, that happens on the next sync rather than immediately. Allow up to an hour, then confirm from your member list that they are actually gone, and contact support if they are not.

Use Rotate Token if the token may have been exposed, or on whatever schedule your security policy requires. Rotation issues a new Base URL and token and immediately invalidates the old pair.

Your identity provider will report authorization errors until you paste the new credentials in, so finish rotation in one sitting. Both values change - updating only the token leaves you pointed at a Base URL that no longer exists. Your default role setting and everyone's existing access survive a rotation; only the credential changes.

Disable Directory Sync removes the connection and its token. This cannot be undone - re-enabling issues a completely new connection and token, and your identity provider has to be reconfigured.

Disabling stops synchronization. It does not remove anyone: everyone the directory already provisioned keeps the access they have; their membership simply stops tracking your directory. If you want people removed, remove them before you disable, or by hand afterwards. Turn provisioning off on the identity-provider side too, rather than leaving it retrying against a connection that is gone.

Mindsmith runs two independent deployments: app.mindsmith.ai (US) and eu.mindsmith.ai (EU). They have separate databases, separate directory connections, and separate credentials.

Your Base URL and token belong to one region only. A connection enabled in one region does not exist in the other, and there is no way to move it across. If you are unsure which region your organization lives in, the Base URL on the Directory Sync card is the answer.

The Directory Sync card shows Recent provisioning activity: the most recent changes your identity provider made, including anything that could not be applied. This is the first place to check whenever something looks wrong, and it stays readable after you disable the connection.

There are no email notifications - the activity list is a place you look, not something that reaches out. Check it after any bulk change in your directory. A few entries call for your attention:

Mindsmith uses BoxyHQ to securely manage SCIM directory connections. For vendor-specific setup details, you can visit this documentation.