Which plans include SSO?

It depends on the plan. The table on this page shows what each plan includes for SSO, enforced sign-in, SCIM, session limits and the audit log API.

What happens if our identity provider is down?

People who manage SSO can still sign in with their password and a two-step check, so you are never locked out. Everyone else waits for the provider.

Does SCIM work with Google Workspace?

No. Google Workspace cannot send SCIM to a custom app. SCIM works with Okta, Microsoft Entra ID and other directories that can push to one.

What happens when someone leaves the company?

When your directory deactivates them, Pulseri removes them from the team, signs them out everywhere and disconnects the assistants they approved. Their past work stays in your reports.

Can we read the audit log from our own tools?

Yes, on the plans marked in the table. A service account key can pull audit events through the API, and your plan sets how long they are kept.

SSO and SCIM

Your team signs in with the account they already have.

Let's talk See pricing

Your domain

Verified

brightpath.example

Checked with a record on your domain

Brightpath single sign-on

Connected

Camila Reyes · Head of Support
Work account
Dana Cohen · Finance Lead
Work account
Ines Duarte · Community Manager
Work account

Activity log

Recorded

09:14 Camila Reyes signed in with a work account

Signed out after 30 minutes away

Single sign-on

Connect your identity provider

One connection per account, set up by an admin.

Your domain

Verified

brightpath.example

Checked with a record on your domain

Brightpath single sign-on

Connected

Camila Reyes · Head of Support
Work account
Dana Cohen · Finance Lead
Work account
Ines Duarte · Community Manager
Work account

Activity log

Recorded

09:14 Camila Reyes signed in with a work account

Signed out after 30 minutes away

An admin picks OIDC or SAML 2.0, pastes in the provider's details and runs a test sign-in.

Prove you own your email domain with one DNS record.
Sign in from Pulseri or from the app tile in your provider.
Choose what a first sign-in does: create an account or require an invite.
Someone with a Pulseri account at the same company is linked to it.
An email that belongs to another Pulseri account is never linked.

Enforcement

Require it, without locking yourself out

Where your plan includes it, everyone at your domains must use your provider.

With enforcement on, anyone with an email at a verified domain must sign in through your provider. Pulseri asks you to confirm, warns affected people ahead of time and lets you choose the start time.

People who manage SSO keep a way back in: their password and a two-step check. If your provider has an outage, they can still reach the dashboard and fix it.

SCIM

Let your directory manage the team

Hire, move and leave in your directory. Pulseri follows.

With SCIM, your directory owns your team's accounts. Create a token in Pulseri and paste it into a custom app in Okta or Microsoft Entra ID.

New people are added, and names and emails stay current.
Link a directory group to a Pulseri role, so access follows group membership.
A group never gives out the Administrator role or other sensitive roles.
Deactivate someone and Pulseri removes them and signs them out everywhere.
Service accounts and keys they made are listed for review, not deleted.

A role from a directory group cannot be changed by hand in Pulseri. Change it in the directory.

Roles

The right access for each person

Single sign-on says who someone is. Roles say what they can do.

Maeve DoyleDesigner

Role

Administrator
Results only
Survey sender

What this person can do

See survey results (Allowed)
Send surveys (Not allowed)
Change who has which role (Not allowed)

Access log

Camila Reyes changed Maeve Doyle to Results only.

Each teammate has a role that sets what they can see and change. On plans that include them, admins can build custom roles. Directory groups can pick the role, so access follows the person.

Control

Session limits and an audit log

Decide how long a browser stays signed in, and keep a record of what happened.

On plans with session limits, you set limits for every browser session in your account, however the person signed in.

An idle timeout signs people out after a quiet period. The default is 2 hours.
A hard limit ends every session after a fixed time. The default and the longest is 7 days.
Your identity provider's own session end is respected too.
The audit log records who changed what, and when. You choose how long to keep it.
On the plans marked in the table, a service account key can read it through the API.

Plans

What each plan includes

Every difference is in this table, the same one the pricing page uses.

Single sign-on (OIDC, SAML): Not included
Verified sign-in domains: Not included
Enforced single sign-on and domain capture: Not included
SCIM user provisioning: Not included
Configurable session limits: Not included
Audit log API: Not included
Audit log retention: 90

Limits by plan
Feature	Starter	Growth	Business	Enterprise
Single sign-on (OIDC, SAML)	Not included	Not included	Add-on	Included
Verified sign-in domains	Not included	Not included	Add-on	Included
Enforced single sign-on and domain capture	Not included	Not included	Not included	Included
SCIM user provisioning	Not included	Not included	Not included	Included
Configurable session limits	Not included	Not included	Not included	Included
Audit log API	Not included	Not included	Included	Included
Audit log retention	30	90	365	Custom

Plans set up with you have no price here. Choose Let's talk and we will reply.

Keep reading

Security: the controls Pulseri has today.
People and segments: group your customers and pick exactly who to ask.

Questions people ask

Okta, Microsoft Entra ID and Google Workspace are supported by name. Any other OIDC or SAML 2.0 provider works too.

Talk to us about SSO and SCIM

Tell us your identity provider and how many people you have. We will reply with what it looks like for your team.

Let's talk See pricing