Identity and access
Workspace identity, organization context, Microsoft Entra readiness, role gates, and platform-admin boundaries.
On this page
Task and prerequisites
Use this guide to join the correct workspace or prepare a supported enterprise sign-in setup. Sign in through the normal Costframe route and confirm the active workspace.
An administrator must verify membership and the requested capability. Enterprise setup needs an authorized identity-provider administrator, eligible domains, an agreed connection and accepted authentication policy.
The optional Azure directory/AVD evidence collector is separate from Costframe sign-in and Directory Sync.
SSO and JIT account creation
SSO sends an eligible user to the configured organization identity provider. Just-in-time (JIT) creation creates an account at sign-in under the accepted policy; it does not continuously synchronize employees, groups or departures.
With SSO alone, an administrator still manages Costframe membership and access. Sessions follow the configured expiry and revocation policy.
A directory change must not be assumed to have invalidated an already-issued session merely because a new sign-in would be refused.
Directory-driven lifecycle and group mapping
Directory Sync is a separate optional add-on that requires SSO. Agree the supported directory, included users, group mappings and removal behavior before activation.
Validate disable/delete, app or group removal, existing-session denial and reactivation through the accepted setup. A mapped directory group does not create an arbitrary custom Costframe role or financial grant.
The presence of a configuration screen or a purchased add-on does not establish that a customer's lifecycle integration is live. No universal immediate-revocation deadline is promised here.
Passkeys and session expiry
Passkeys are a sign-in method, not an extra paid enterprise connection. For an SSO-managed workspace, the identity provider controls accepted authentication methods and strength.
Do not enable a local account, guest or passkey route that bypasses required organizational SSO. Ask the identity administrator to confirm session duration, expiry, routine offboarding and the approved emergency recovery path.
Expiry eventually requiring a new login is different from active session revocation.
Steps and expected result
Accept the invitation with the intended account, sign in normally and select the authorized workspace. Ask its administrator to check the current membership and role if access is missing.
For enterprise setup, agree domains and policy, configure the supported provider connection through the authorized process, then test permitted and denied sign-ins. If Directory Sync is included, test lifecycle and group behavior separately.
The expected result is verified access to the intended workspace and capability, with no access to another organization. A successful login does not itself grant financial or personal-data access.
Limitations and troubleshooting
If login succeeds but a page is denied, check the active workspace, current membership, role, financial grant and plan eligibility. If an invitation expired, ask the administrator for a new invitation; do not create a duplicate workspace to regain access.
For enterprise login or offboarding failures, stop relying on the unverified flow and contact the identity administrator and support with the safe error and time. Do not send passwords, MFA codes, session cookies or tokens.
Platform support is a separate allowlisted read-only boundary, not a customer access bypass.