Crow NestDocs
/

Accounts and billing

IT admin

This page is for the people who run a company's tools. It applies to companies set up by Crow Nest and to organizations. "Admin" means a company's admins, or an organization's owner and managers. Members don't see any of these pages.

Add and remove people automatically (SCIM)

Crow Nest speaks SCIM 2.0, so Okta and Microsoft Entra can add people when they join your company and turn off their access when they leave. People still sign in with Google or Microsoft.

  1. Open People, then Automatic sign-up (SCIM), and choose Create a token. The token is shown once. Copy it now.
  2. Copy the base URL shown on that page. It looks like https://api.crow-nest.com/scim/v2.
  3. Connect your identity provider:

Okta

  • Open your SCIM 2.0 app, then Provisioning and Integration.
  • Set the base URL, set the unique identifier field to userName, and choose HTTP Header authentication with the token.
  • Turn on Create Users, Update User Attributes and Deactivate Users.

Microsoft Entra

  • Go to Enterprise applications, New application, Create your own application, then Provisioning and Automatic.
  • Set the Tenant URL to the base URL and the Secret token to the token.
  • Test the connection, then turn provisioning on.

What happens:

  • A new person gets an account and a membership as a member. They sign in later with Google or Microsoft as that email and land in your workspace, with no invite step.
  • Someone who already uses Crow Nest with their own apps isn't moved. They get a message to be invited from Crow Nest instead, so they can choose what moves. Someone with an empty personal workspace is moved in.
  • A company set up by Crow Nest only accepts emails from its own domains.
  • Turning someone off (active: false, or deleting them) removes them as described below. Turning them back on restores their membership, not their apps.
  • A person who was turned off and signs in sees "Your company has turned off your Crow Nest access. Ask your IT team." and gets no workspace.
  • Roles aren't set by SCIM. Everyone joins as a member and admins change roles in Crow Nest. Seats are charged the same as for invited people.

Make a new token to replace the old one, or Revoke it to stop syncing. Only one token is active at a time.

When someone leaves

Removing a person (Remove on People or Members, SCIM, or the person leaving) does all of this at once:

  • Their apps in the workspace pass to the person you choose, with their shares and settings unchanged. With no choice, they go to the workspace's offboarding person, else the owner.
  • Their sessions, API tokens and AI tool sign-ins stop working.
  • Shares of the workspace's apps to their email are removed.
  • Their personal AI keys are taken off the workspace's apps; those apps use the company key, or AI turns off.
  • Domains, company AI keys and anything else the workspace owns stay.
  • They get a new personal workspace. The person who receives the apps gets one email listing them.

Before you confirm, Remove shows the list of apps with their visibility and how many people each is shared with. Your AI shows the same list with org_members.

Activity log

Activity lists changes and access decisions for the last 400 days: dashboard sign-ins, publishes, rollbacks, deletes, visibility and share changes, pauses, members added and removed, role and policy changes, SCIM token changes, AI key and secret names (never their values), domain changes, and exports. Opening an app is not logged. See that in stats.

Each row shows who (a person, SCIM, Crow Nest staff, or the system), what, which app or person, when, and the IP and browser. Filter by date, person, app and action, then choose Download CSV for up to 100,000 rows. The export itself is logged. Your AI can read the latest 50 rows with org_activity.

Limit sharing to partner domains

On Policy, with sharing outside the company allowed, add Partner domains. Outside shares then only work for those domains, matched exactly: partner.com doesn't allow sub.partner.com. The refusal names the allowed domains. Public and link sharing follow their own switches.

Changing the policy never changes apps by itself. The Apps the policy no longer allows list shows public apps, link apps and outside shares the policy would refuse now. Bring these in line sets those apps to your company, removes the outside shares, logs each change and emails each app's owner once.

See also Organizations and companies and Sharing.

View this page as Markdown