Description

Ensure Directory Sync is connected between the Vercel team and the organization's identity provider, and that it is actively syncing. Directory groups should be mapped to the correct Vercel team roles, so users added, changed, or removed in the directory are updated in Vercel automatically.

Rationale

When team members are managed by hand, former employees and users who changed teams often keep access long after they should. Directory Sync makes the identity provider the source of truth for team membership and roles, so removing someone from the directory also removes them from Vercel, without any manual steps.

Impact

  • Users removed from the directory are removed from Vercel

  • Vercel roles follow directory group membership

  • Removes manual onboarding and offboarding steps

Default Value

By default, Directory Sync is not configured and members are managed manually. It is available only on the Enterprise plan.

Pre-Requisites

  • Team Owner role

  • Enterprise plan

  • Admin access to the identity provider

  • At least one user mapped to the Owner role, to avoid lockout

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Security & Privacy.

  4. In the Authentication and User Provisioning section, verify that Directory Sync is configured.

  5. In the identity provider, verify that provisioning to Vercel is enabled and the last sync succeeded.

  6. If Directory Sync is not configured or is failing, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Security & Privacy.

  4. In the Directory Sync row, select Configure.

  5. Follow the dialog to connect your identity provider.

  6. Map directory groups to Vercel team roles, making sure at least one administrator is mapped to Owner.

  7. Review the list of members and click Confirm and Sync.

Backout Plan

  1. Sign in to the identity provider's admin console.

  2. Open the Vercel application and turn off provisioning (SCIM).

  3. In Vercel, open Settings > Members and manage member roles manually from now on.

Reference