Umbra
Start free
← All docs

Workspaces + SSO

Per-org isolation. Google + Microsoft OIDC sign-in. Email invites with role pre-selection.

Last updated May 27, 2026

What it is

Multi-tenant workspaces with isolation between orgs at every layer (database row, RBAC scope, audit log, notification target) plus SSO via Google + Microsoft OIDC for password-free sign-in.

What it produces

Per workspace:

  • An orgs row with name, slug, plan, AI ledger, asset cap
  • A membership list (one or more users) with roles
  • An invitation log (sent, accepted, revoked)
  • A complete data isolation boundary: every query is scope-checked against the calling user’s org_id at the type-system level (auth.MustOrgID returns it; no handler can read the body).

What to use it for

  • One-team-per-workspace: small teams need one
  • MSSPs: one workspace per customer is the safe split (use Companies for one-workspace-many- customers when you want shared sight)
  • Federated identity: Microsoft AD / Google Workspace tenants sign in with their existing account

Why it matters

Tenancy is a hard-stop concern for security buyers. Every B2B security vendor at some point gets the “show me your tenancy model” deck request. We answer that with “per-row org_id + type-system-enforced scope checks,” not “we have access control.”

Why it’s valuable

  • Type-enforced isolation. A handler that forgets to call requireOrgRole doesn’t compile against the route table that expects it; the most common cross-tenant data-leak shape is prevented at the language layer.
  • OIDC out of the box. No “configure your IdP” tutorial; just click “Sign in with Google” or “Sign in with Microsoft.” Auto- provisioning the user row on first sign-in.
  • Workspace rename is platform-superadmin-only. Customers can’t accidentally rebrand their own org (the name appears on invoices); Umbra staff handle changes on request.

How to use it

  • Signup at https://app.umbrascope.com/#/signup creates the workspace
    • the first user as org_owner.
  • Settings → Team → Invite sends an email with a 24h-valid signup link. Pick the invitee’s role in the invite form.
  • OIDC is configured via env vars at the deployment level (UMBRA_OIDC_GOOGLE_CLIENT_*, UMBRA_OIDC_MICROSOFT_CLIENT_*); the sign-in page autodetects which providers are configured and shows the buttons.

What’s not shipped yet

  • SAML SSO and SCIM user provisioning are on the roadmap, not yet available. Today SSO is OIDC-only (Google / Microsoft); if you need a SAML IdP or automated SCIM deprovisioning, use OIDC auto-provisioning plus email invites for now and talk to us about timelines. Don’t expect a SAML login flow in the product yet.

Related: