Directory sync: what happens when someone leaves

Directory sync (SCIM 2.0) connects your identity provider to Turtini so joiners and leavers are handled by the system you already use for everything else.

**Connect it**

1. Open **Settings -> Organizations -> Directory sync**.
2. Press **Create token**, give it a name like "Okta production". The token is shown **once** -- copy it now; Turtini stores only a hash of it and can never show it to you again.
3. In your identity provider, add Turtini as a provisioning application. Paste the **SCIM base URL** shown on that panel, choose **HTTP Header** / **OAuth bearer token** authentication, and paste the token.
4. Test the connection in your provider, then assign the people who should have access.

**When someone is hired**

Your provider creates them. Turtini finds their existing Turtini account if they already have one -- including the case where their work address differs from the address they already use here -- and links it rather than creating a second account. If they are new to Turtini, an account is created **with no password**, so their only way in is through your identity provider.

They are added to your organization as a **member**. Directory sync never changes the role of somebody who is already in your organization, so it cannot demote an owner and lock the organization out of itself.

**When someone leaves**

The moment your provider deactivates or unassigns them, Turtini:

1. Removes their membership in your organization. Every org-scoped permission goes with it.
2. Ends every session they have open, on every device. An already-open browser tab cannot renew itself.
3. Records the removal, with the date, on the Directory sync panel -- deactivated people stay listed with the date their access ended, because "when did access end" is the question you will actually be asked.

**What is deliberately not deleted**

Their personal Turtini account. Your directory owns the employment relationship, not the person -- deleting the account would destroy personal data your organization never owned. What ends is their access to your organization, which is the thing you asked to end.

**Rotating or turning it off**

Revoke a token on the same panel; your provider stops being able to sync immediately. Existing memberships are untouched -- revoking a token is not an offboarding event. Create a new token to reconnect.

**Not supported yet**

Group push. If your provider offers it, leave it off -- Turtini answers that request with a clear "not supported" rather than silently accepting groups it will not act on.