Set Up Secure Enterprise Access

Bring a representative group of users into Apidog and verify that each person has access only to the intended Teams and Projects. You can invite users directly or use SSO; both routes finish with the same access-validation checkpoint.

Journey: Enterprise Onboarding Journey → Set Up Secure Enterprise Access → Migrate and Validate Your API Data → Establish Your Team's Apidog Workflow

Prepare the pilot access plan

Before adding users:

Confirm the Organization Owner and an administrative backup.

Identify the Teams and pilot Project that users need to access.

Select representative Admin, Editor, Read-only, and restricted users.

Record the expected Organization role, Team role, and Project role for each pilot user.

Confirm the customer's deployment using the Enterprise Onboarding Journey. Feature availability and navigation can differ for Apidog On-Premises.

Organization, Team, and Project permissions are separate. An Org Admin can manage the organization's structure and settings but does not automatically receive access to every Project. Review Organization Role & Permissions and Team Roles & Permissions before assigning access.

Choose how users will enter Apidog

Route	Use when	Primary owner
Invite users directly	An Org Admin, Team Admin, or Project Admin will add the initial users at the appropriate level. This is suitable for a small pilot or a manually managed rollout.	Org Admin, Team Admin, or Project Admin
Use SSO	An identity provider should authenticate users and, when configured, map groups to Teams.	Identity administrator and Org Admin

You can use direct invitations for the pilot and introduce SSO for a later rollout. Complete the same access checks regardless of the route.

Route A: Invite users directly

Choose the invitation level based on the access each person needs.

Invite from	Use when	Confirm
Organization	Administrators are creating the enterprise member pool and assigning users to one or more Teams.	Organization role, Team assignments, Team roles, and resulting Project access.
Team	Internal users need access to several Projects within one Team.	Team role and the role for each relevant Project.
Project	A user should access one Project, such as an external or cross-functional collaborator.	Current Project role, resulting Team role, and access to other Projects.

Invite the pilot users

If inviting at the Organization level, confirm that the Organization has at least one Team.

Invite each user from the Organization, Team, or Project level that matches the required access.

Assign the intended Organization and Team roles where those settings apply.

Assign the required Project role: Admin, Editor, Read-only, Forbidden, or an approved custom Project role.

Review access to the other Projects in the Team, especially for external collaborators.

Test the representative users before inviting the remaining population.

Use the dedicated guides while completing this route:

Managing Organization

Managing Team Members

Managing Project Members

Team Roles & Permissions

Route B: Connect SSO

Use SSO when authentication and Team assignment should follow the organization's identity process. Keep SSO, SAML Group Mapping, and SCIM responsibilities distinct.

Capability	What it does	Important boundary
SAML SSO	Authenticates users and can add them to the Organization.	Users are not assigned to Teams by default unless SAML Group Mapping is configured.
SAML Group Mapping	Maps identity-provider groups to Apidog Teams and grants initial Project permissions.	The initial Project role depends on the mapped Team role. Group Mapping does not provide a separate role setting for each Project.
SCIM	Automates supported user provisioning and removal.	SCIM does not manage groups. Use SAML Group Mapping for identity-provider group-to-Team mapping.

Configure the pilot SSO flow

Confirm that the Organization uses an Apidog Enterprise plan and that the identity provider supports SAML 2.0.

Configure the identity provider using the appropriate guide:

Configuring Microsoft Entra ID

Configuring Okta

Configuring JumpCloud SSO

Complete and test the Apidog-side setup using Configuring SSO for an Organization.

If Teams should be assigned from identity-provider groups, configure Mapping Groups to Teams. Review the initial Project permissions produced by each mapped Team role.

Add SCIM Provisioning only when supported user provisioning and removal are required.

Review each user's Organization membership, Team assignments, and Project roles. Adjust Project-specific roles where the initial role is not sufficient.

Test a user without the intended group mapping and verify that the user does not receive unauthorized Team or Project access. If SCIM is enabled, also test its supported add and remove behavior.

For an overview of the SSO flow and user membership behavior, see SSO Overview and Managing User Accounts.

Validate access for both routes

Test the same representative access set whether users were invited directly or entered through SSO.

Representative user	Expected access	Validation
Admin user	Project Admin	Can manage the pilot Project and its members.
Editor user	Project Editor	Can create and modify the intended Project content.
Read-only user	Project Read-only	Can view and run permitted content but cannot edit it.
Restricted user	Project Forbidden or no Project membership	Cannot open the pilot Project.

Record the expected result, actual result, and owner of any exception. Correct access issues before adding more users.

Complete the access phase

The selected invitation or SSO route works for the pilot users.

Every representative user has the intended Organization and Team membership.

Each pilot user's Project role matches the access plan.

Admin, Editor, and Read-only behaviors match the expected permissions.

The restricted user cannot access the pilot Project.

SAML Group Mapping produces the intended initial Project access, if configured.

Supported SCIM add and remove behavior works as expected, if configured.

Identity or access exceptions have named owners.

This phase is complete when representative users have only the intended access and the organization can repeat the selected route for the next group.

Set Up Secure Enterprise Access

Prepare the pilot access plan#

Choose how users will enter Apidog#

Route A: Invite users directly#

Invite the pilot users#

Route B: Connect SSO#

Configure the pilot SSO flow#

Validate access for both routes#

Complete the access phase#