Directory sync

Directory sync keeps Novu organization membership aligned with the identity provider. It is how you create dashboard users before they sign in, and how you remove their access when they leave, without waiting for the next login. This provisions the people who sign in to Novu. It does not create subscribers. Subscribers are the people your workflows notify.

​

What it does

• Create. A person provisioned in the IdP gets a Novu account before they sign in. If that email already belongs to a Novu account, the directory links to that account instead of creating a second one.
• Update. Name and email changes in the IdP are written onto that account.
• Deactivate. When the IdP deactivates or removes the person, their Novu sessions are revoked and the account is deactivated. A SCIM delete does the same thing to that directory’s link. It does not delete the Novu account.

Okta and Microsoft Entra ID apply this on their own provisioning schedule, which is often several minutes later. Google Workspace is polled about every five minutes. You can also run Sync now for Google. Only email addresses on a verified domain for the SSO connection are processed. A test user on another domain never shows up.

​

SSO first

Directory sync is attached to an SSO connection. It does not replace SAML or OpenID Connect. You can finish directory sync before you activate SSO. The wizard warns you that members can be provisioned immediately and cannot sign in until SSO is active. That is useful when you want the organization populated before you move everyone to the IdP. On the Security tab, Start configuration stays disabled and shows an SSO Required badge until an SSO connection exists. The connection does not have to be activated yet. The directory provider follows the SSO provider. You do not pick a second provider. Novu does not add a second activate button for SCIM. The IdP can push after the endpoint and token are saved and provisioning is turned on in the IdP. The provider pages name that switch. Google Workspace turns on when the service account credentials validate.

​

Bearer token

Google Workspace does not use this token.

​

Attributes

On the Review attributes step, these mappings are already set and cannot be edited there: Whether the account is enabled follows the SCIM active attribute. A SCIM delete is treated as a deactivation. Fields that are not in this table are not applied from the Security tab.

​

Test provisioning

Assign or push a user whose email is on a verified domain. While the test step is open, it lists recent activity with the email, name, time, and Active or Deprovisioned status. Complete closes the wizard. The directory is already active by then. Complete does not turn it on. Google has nothing to push. The test step shows the last sync result and Sync now, which reads the directory immediately instead of waiting for the next five-minute poll.

​

Offboarding

Deactivation follows the IdP schedule described above. Check these cases before you treat a removal in the IdP as finished:

• If the person was also invited from Settings > Team, outside directory sync, removing them in the IdP withdraws the directory’s access and leaves the invited membership in place. Remove that membership by hand if they should lose the organization.
• If more than one directory manages the same person, they stay active until every enabled directory has deprovisioned them. A paused directory does not count toward that.
• Pausing or deleting the directory is not the same as deactivating a person in the IdP. That behavior is under After setup.

​

Groups and roles

The Security tab does not map IdP groups to Novu roles (Owner, Admin, Author, Viewer). You can push groups from Okta, and Google Workspace groups are read with the directory, but group membership does not change a role from this page. Ask us if you want a group to set a Novu role. If we turn that on, only direct membership counts. A person who is in a mapped group only because they belong to another group does not get that role.

​

After setup

The section shows Unconfigured, Active, or Inactive. The menu then has:

• Edit. Generate a new bearer token, or review recent provisioning. For Google, this is also where you replace the service account key or run a sync.
• Deactivate / Activate / Remove. A Google directory cannot be activated until a service account key is stored.

Deactivate pauses new sync from this directory and withdraws organization access that only this directory granted. It does not delete Novu accounts, the directory, a SCIM bearer token, or a stored Google service account key. A membership created from Settings > Team, or still granted by another directory, stays. Activate resumes sync. Access returns from the directory’s current state, not from a snapshot of who was a member before the pause. Remove deletes the directory after you type the organization name.

• A membership that came only from this directory is removed.
• An invitation membership, or access still granted by another directory, stays.
• The Novu account is not deleted. If this was the only directory for that person, removing it does not sign them out. Deactivate them in the identity provider, and wait until that change has synced, before you remove the directory if they must lose access.
• For SCIM, the bearer token is deleted. Setting directory sync up again creates a new endpoint and a new token.
• For Google Workspace, Novu’s copy of the service account key is destroyed. That does not delete the key in Google Cloud. Delete it there if it may have leaked.

​

If provisioning fails

The provider pages have the field names for each console: