# Provisioning and approval

Step 6 of the wizard, and the decision that determines who can walk in.

## Default role for new sign-ins

- **Developer** — the person is immediately a developer and can use the Endpoint Suite.
- **Pending approval** — they exist but can do nothing until an admin approves them.

## Require admin approval for every new user

Same effect, stated as a switch. With it on, every first-time sign-in waits for a human.

## Allowed email domains

A list. Only people whose email is in one of these domains can provision an account at
all.

**Set this.** Without it, the gate is only whatever your identity provider allows, and
identity providers are frequently configured to allow more than you think — guest
accounts, contractors, personal accounts if you enabled them in Entra.

## Approving people

Pending users appear on **Users & Teams → Developers** with a **Pending** badge and an
**Approve** button. Nothing else about them changes on approval; they simply become able
to work.

## Seats

An SSO-provisioned developer consumes a seat exactly like an invited one. If your identity
provider hands you a hundred people on day one, they will consume a hundred seats — which
is another reason to start with pending approval rather than automatic developer.

## SSO people and passkeys

Developers who arrive through SSO show "Signs in via SSO" instead of a resend-passkey
action. Their credentials live in your identity provider; Sentilai does not manage them.