# Identity and access + Krokul CRM

Krokul CRM supports single sign-on with Okta and Microsoft Entra ID over SAML 2.0 or OpenID Connect, and user provisioning over SCIM 2.0. People sign in with their company account, directory groups map to the four Krokul roles, and a person deactivated in the directory loses access to Krokul on the next sync. Sign-in with a Google or Microsoft account covers smaller teams without a directory.

## Services

## What your team gets

### One company sign-in for the sales team

An admin adds Krokul as an app in Okta or as an enterprise application in Entra ID. Krokul sends each sign-in to the identity provider, so password policy and multi-factor rules are the same as for every other company tool.

### Joiners, movers and leavers handled by the directory

When HR adds a person to the Sales group, a SCIM request creates the Krokul membership with the role mapped to that group. A move to Sales Managers changes the role on the next cycle and lands in the Krokul audit log. Deactivation blocks the membership, ends open sessions and stops the AI client connections of that person.

### Systems get keys, people get accounts

Integrations sign in with Krokul API keys, each with a scope, a role and an expiry. No directory account is involved. The admin sees the call log of every key and revokes one without touching any person.

## What to know

The identity provider decides who may sign in and which groups a person belongs to. Krokul keeps the CRM side, which covers the deals an agent sees, the pipelines, and the permissions of API keys and AI connections.

## Questions and answers

### How are Krokul roles assigned from the directory?

An admin maps directory groups to admin, manager, agent and viewer. A person in several mapped groups gets the highest of the mapped roles.

### What happens to API keys when a person leaves?

Company API keys are not tied to a person, so they keep working until an admin revokes them. The AI client connections of that person stop with the next call.

### Do other identity providers work?

Yes, any provider that speaks SAML 2.0 or OpenID Connect for sign-in and SCIM 2.0 for provisioning.

## Other categories

- [AI assistants](https://krokul.com/en/integrations/category/ai-assistants/index.md)
- [Automation platforms](https://krokul.com/en/integrations/category/automation/index.md)
- [Team chat](https://krokul.com/en/integrations/category/team-chat/index.md)

Updated: 2026-10-12

---

App: https://app.krokul.com/ · API: https://app.krokul.com/api/v1/docs