Identity & access
SSO · group sync · roles
Bee Flow does not want to be your identity provider. It signs people in with OAuth against Google, Microsoft Entra ID — single-tenant or multi-tenant — or Nextcloud, mirrors your groups instead of asking anyone to rebuild them, and decides everything else with six built-in roles and a rights model that only ever grants, never silently widens. This page walks the whole chain: who gets in, which organisation they land in, what they can touch, and where that is written down when an auditor asks.
Run it on your own tenant Security & encryptionThe directory does the work
Access management fails at the second admin console. So Bee Flow reads the one you already run.
Switch on the periodic sync — six hours by default once enabled, and configurable — and it reads the groups assigned to the Bee Flow enterprise app and mirrors them here, members included. On top of that, a Microsoft sign-in re-checks that person against the groups already mirrored, so a membership change in Entra is reflected when they arrive rather than at the next interval; that login pass is also where removals land, because someone dropped from a group in Entra loses what the group granted. Deleting Azure-managed groups outright is a separate opt-in, so the sync cannot dismantle local structure by accident. On a plan with a seat limit, provisioning stops at that limit rather than silently exceeding it.
Webhooks mirror Nextcloud users and groups in near real time, with a six-hour reconciliation pass as the backstop for anything a webhook missed. Three modes per organisation: mirror everything, mirror selected groups, or manual. Nextcloud sign-in ships in the free Community tier; Google and Microsoft SSO are part of Enterprise.
Organisation admin, agent admin, agent editor and member cover the day-to-day. Alongside them ship a Data Protection Officer role and an ISMS auditor role, because GDPR work and ISO 27001 work are real jobs with their own permissions rather than "give them admin and hope". Custom roles compose from around twenty-five granular permissions when the built-in six are not the right cut.
Assistants, knowledge bases, skills and apps are private to their owner until shared — with the whole organisation or with specific groups. That is where the directory sync pays off: share a knowledge base with the Entra group for your finance team, and membership changes in the directory change access here, with nobody maintaining a second list. Apps built in App Studio go a level deeper, with row-level access rules enforced inside the app itself.
The journey
A sign-in from your company domain lands in your organisation. A free-mail address — gmail.com, outlook.com and friends — deliberately never auto-binds to any organisation: that guard exists because we watched how easily a personal account could otherwise end up inside a tenant it had no business in. Country allowlists and invite links narrow the door further when you want them to.
People who sign in through SSO arrive as pending until an organisation admin approves them — or, with auto-approval switched on for a domain you trust, they land directly in the default groups you chose. A waitlist mode exists for when the door should stay closed entirely. Two things worth knowing: founders and platform admins are never locked out by their own approval flow, and colleagues provisioned by the directory sync itself are activated straight away unless you turn that off.
pending → approved · auto-approve + default groups · waitlist
Access is decided in four layers: what the licence allows, what the platform operator made available, what your organisation admin granted, and what a group grants on top. Every layer can only add — nothing a group does can silently take away, and nothing an admin forgets can silently widen. This is the "one permission model" the rest of this site keeps mentioning, and this is the page where it is spelled out.
licence → availability → org grant → group grant
In writing
The boundary
FAQ
Yes — OAuth sign-in with Google, Microsoft Entra ID and Nextcloud, with single-tenant and multi-tenant Microsoft setups both supported. Nextcloud sign-in is part of the free Community tier; Google and Microsoft SSO are Enterprise features. SAML is not implemented, and we say that out loud rather than in a footnote.
Yes. An optional periodic sync — six hours by default once you enable it, and configurable — mirrors the groups assigned to the Bee Flow enterprise app. On top of that, a Microsoft login re-checks that person against the groups already mirrored here, which is where memberships they have lost are dropped. Deleting groups that vanished from Entra is a further opt-in called destructive sync, off by default. One caveat worth knowing: a brand-new group assigned in Entra arrives with the periodic or a manual sync, not through someone logging in.
No, and this page exists partly so nobody discovers that late. What ships is OAuth/OIDC SSO against three providers, plus group sync from Entra ID and Nextcloud — which covers most of what teams reach for SCIM for: keeping membership current without a second admin console. If SAML is a hard requirement, we are the wrong choice today.
Yes: bind sign-ins to your email domain, hold new members pending until approved, auto-approve with default groups on a domain you trust, run a waitlist, restrict signups by country, or invite explicitly. Free-mail addresses never auto-join an organisation, whatever the other settings say.
Six built-in organisation roles — including a Data Protection Officer role and an ISMS auditor role — plus custom roles built from around twenty-five granular permissions. Resources are shared per organisation or per group, four grant-only layers decide which capabilities exist for whom, and every access change lands in an audit log designed for GDPR Article 30 evidence.
Yes — TOTP with any authenticator app, enrolled from a QR code, with ten hashed recovery codes and an admin reset path for lost devices. It is enforced on the standard password login; accounts migrated to the OPAQUE key-exchange path do not have the second factor enforced yet, and we would rather write that here than let you discover it.
The fastest way to evaluate the identity story is to run it: connect your Entra tenant or Nextcloud on a test install, watch the groups arrive, and read the audit log afterwards.
Self-host it Talk to us