Users, SSO & SCIM

User management

The users view (root admin only) manages all accounts: create, disable, send a password reset email, reset 2FA.

Sign-in

• Email + password with optional two-factor authentication (TOTP, set up in your own profile).
• Microsoft SSO: "Sign in with Microsoft" — configured in Settings → SSO (Entra app registration with client ID/secret and tenant). Can complement or effectively replace password sign-in.

Root admin

For the root admin, 2FA is mandatory and cannot be disabled — not even through workarounds. On the very first start, the root admin signs in via a magic link from the container log and goes through the root setup (password → 2FA).

Changing the root admin email

The root admin can change their own email address in Settings → Security (field "Change email address", protected by the current password). Changing it signs out all other sessions; the current one stays active.

Technical background: The root admin's identity is taken from the environment variable ROOT_ADMIN_EMAIL on first start, but is kept in the database afterwards and can therefore be changed without a redeploy. ROOT_ADMIN_EMAIL remains the recovery anchor: if no value is stored in the database (fresh installation or deliberately reset), the environment variable applies again.

SCIM provisioning (Entra)

Multiverse provides a SCIM 2.0 endpoint for Microsoft Entra: users are automatically created, updated, and disabled when they are assigned or removed in the Entra enterprise app provisioning.

• Settings → SCIM: generate a token and store it together with the endpoint URL in Entra (Provisioning).
• The endpoint lives at …/api/scim/v2 and is authenticated via bearer token.