User lifecycle & seats
With SCIM connected, your Okta group is the source of truth for team membership.
User assigned to the group
Okta pushes the user within moments. LocalCan creates an active membership and assigns a license key from the unassigned pool. No invitation, no acceptance step, no owner involvement. Bulk assignments work the same way.
Provisioned user signs in
The user enters their work email on the LocalCan login page and is redirected to Okta and back. They copy their license key from the Licenses page, self-serve. If no license was free at provisioning time, one is assigned at sign-in as soon as seats free up; a Claim license button is available too.
User deactivated or unassigned
LocalCan removes the membership, unassigns the license and rotates the key (the old key stops activating the app), and revokes their dashboard sessions. Re-assigning later re-provisions cleanly. Offboarding is recorded in the team audit log.
When access ends, per plane:
| Plane | Effect |
|---|---|
| Dashboard session | Immediate |
| App activation / license validation | Immediate (key rotated) |
| Live tunnels | At the next periodic license revalidation |
One guardrail: your IdP cannot deprovision the LocalCan team owner. That single deprovision is refused (Okta shows an error task) and everything else proceeds. Ownership changes are made in LocalCan.
More users than seats
By default LocalCan still provisions the extra users as members without a license, and the team owner gets one summary email per sync (not one per user). When seats are added, waiting members get licenses automatically, or pick one up by signing in or clicking Claim license.
Two optional modes, configurable on the SSO settings page:
- Auto-expand: a paid seat is added automatically the first time a provisioned-but-unlicensed member signs in. Billing is triggered by a real user signing in, never by the Okta push, so group churn can't generate charges. Every auto-purchase is recorded in the audit log.
- Hard-block: Okta receives an error at the seat cap (visible in Okta Tasks) and no member is created until seats are added.
If Okta is down
The login page always shows "Sign in with a code instead", which emails a one-time code with no Okta involvement. An IdP outage never locks your team out.
© 2026 LocalCan™. All rights reserved.