Provisioning and approval

Step 6 of the wizard, and the decision that determines who can walk in.

Default role for new sign-ins

• Developer — the person is immediately a developer and can use the Endpoint Suite.
• Pending approval — they exist but can do nothing until an admin approves them.

Require admin approval for every new user

Same effect, stated as a switch. With it on, every first-time sign-in waits for a human.

Allowed email domains

A list. Only people whose email is in one of these domains can provision an account at all.

Set this. Without it, the gate is only whatever your identity provider allows, and identity providers are frequently configured to allow more than you think — guest accounts, contractors, personal accounts if you enabled them in Entra.

Approving people

Pending users appear on Users & Teams → Developers with a Pending badge and an Approve button. Nothing else about them changes on approval; they simply become able to work.

Seats

An SSO-provisioned developer consumes a seat exactly like an invited one. If your identity provider hands you a hundred people on day one, they will consume a hundred seats — which is another reason to start with pending approval rather than automatic developer.

SSO people and passkeys

Developers who arrive through SSO show "Signs in via SSO" instead of a resend-passkey action. Their credentials live in your identity provider; Sentilai does not manage them.