twingate-identity

Role

Decisions & Guidelines

• Always configure both SAML and SCIM together. SAML handles auth; SCIM handles lifecycle. Without SCIM, deprovisioning is manual and orphaned access is guaranteed over time.
• Resources are assigned to Groups, not to Users. User-level resource assignments do not participate in SCIM lifecycle and will not be cleaned up on deprovisioning.
• Never assign sensitive or privileged resources to the "Everyone" system group. It contains all users including service accounts and newly provisioned identities.
• Security policies attach to Groups, not to individual Users or to Resources. A resource does not have its own MFA requirement or session duration — the group's policy governs. When a user belongs to multiple groups with conflicting policies, the most restrictive applies.
• SYNCED group membership is owned by the IdP. Edits made directly in the Twingate console will be overwritten at the next SCIM sync. Manage SYNCED groups via the IdP exclusively.
• Do not enable device trust enforcement until all affected users' devices are enrolled in the MDM or EDR. Enabling early locks out users whose devices aren't registered yet.
• When running multiple IdPs, enforce strict email uniqueness. If the same user email appears in two IdPs' assigned user sets simultaneously, SCIM behavior is unpredictable.
• Prefer the supported native integration over custom automation. Reach for the community/SE tooling in

  references/

  only when no native path exists, and tell the user which repos are experimental or reference-only rather than production-ready.

Search References First

references/

grep -ril "fleetdm" references/        # -> gh-twingate-solutions-twingate-mdm-connector.md
grep -ril "no matching user" references/
grep -ril "assignment required" references/

Routing

references/

• → twingate-architect: for Resource definition, Remote Network design, or deployment sequencing questions
• → twingate-idfw: for protocol-level identity enforcement on top of network access — SSH PAM, Kubernetes gateway, session recording, and Privileged Access for Web Apps (SSO into a self-hosted app, injecting/forwarding the user's identity into HTTP requests, per-request access audit). If the user asks how to carry IdP identity into an app, or to audit app access per user, load it.
• → twingate-troubleshoot: when the user reports access failures tied to policy misconfiguration, device trust, group sync, or SCIM errors
• → twingate-dns-security: for DNS Security Profiles, exit networks, and per-group internet filtering — separate from access security policies
• → twingate-api: when the real task is scripting the Admin GraphQL API rather than designing the identity model

References

references/

• {slug}.md

  — summaries of

  twingate.com/docs

  pages (product documentation).

• {numeric-id}-{slug}.md

  — Twingate help-center articles: symptom-shaped support content, exact error strings, and per-IdP gotchas.

• gh-{org}-{repo}.md

  — summaries of public Twingate GitHub repos: SE and community tooling, reference implementations, and automation.

identity-providers.md

identity-provider-setup.md

okta-configuration.md

okta-app-configuration.md

okta-scim-configuration.md

saas-app-gating-with-okta.md

entra-id-configuration.md

entra-id-app-gating-office-365.md

saas-app-gating-with-entra-id.md

google-workspace-configuration.md

saas-app-gating-with-google-workspace.md

jumpcloud-configuration.md

saas-app-gating-with-jumpcloud.md

onelogin-configuration.md

onelogin-configuration-scim.md

saas-app-gating-with-onelogin.md

keycloak-configuration.md

using-active-directory-with-twingate.md

scim-provisioning-api.md

security-policies.md

security-policies-best-practices.md

security-policy-guides.md

security-policies-migration-guide.md

sign-in-policy.md

two-factor-authentication.md

two-factor-authentication-security-policies.md

trusted-devices.md

device-posture-checks.md

managed-devices.md

device-security-guide.md

windows-managed-devices.md

manually-verified-devices.md

managing-devices.md

device-failures.md

devices.md

device-only-resource-policies.md

jamf-configuration.md

jamf-mdm.md

kandji-configuration.md

kandji-mdm.md

iru-configuration.md

iru-mdm.md

intune-configuration.md

omnissa-workspace-one-mdm.md

crowdstrike-configuration.md

sentinelone-configuration.md

1password-configuration.md

isTrusted

gh-twingate-solutions-twingate-mdm-connector.md

gh-twingate-solutions-idp-migrator.md

gh-twingate-labs-tg-group-profile-manager.md

gh-twingate-labs-tg-group-profile-manager-helm.md

gh-twingate-solutions-twingate-wayfinder-app.md

gh-twingate-labs-saml_service_provider.md

jit-access-requests.md

resources-reviewing-access-requests.md

ephemeral-access-to-resources.md

vendor-and-contractor-access-management.md

usage-based-auto-lock.md

groups.md

users.md

admins.md

offboarding-users.md

authentication.md

how-sessions-work.md

social-logins.md

service-accounts-guide.md

saas-app-gating.md

saas-app-gating-best-practices.md

4707021810-entra-id-all-users-are-able-to-log-into-twingate-even-though-they-are-not-assigned.md

4139538626-microsoft-social-logins-fail-with-an-entraid-account-there-is-no-matching-user-in-this-tenant.md

references/