Identity

Identity brings organization membership and access together. Use it to manage meil users, organize access groups, and connect external apps to onmeil.eu as the identity provider.

Open admin.onmeil.eu/identity. Identity is part of business administration and applies to the workspace, not a private meil account.

Check the status first

When the page opens, it shows the identity engine’s workspace status:

Status	Meaning
Ready	Identity data can be used in the pages and actions below.
Processing	Setup is in progress. Wait before creating a new integration.
Failed	Setup stopped. Read the error and use Try setup again after the cause has been resolved.
Not set up	The workspace does not yet have a completed identity organization.

This status applies to the whole workspace. A successful page load does not mean that an external OIDC, SAML, or SCIM provider is already configured.

Identity tabs

Overview

Overview shows the combined status of members, access groups, connected apps, and SCIM tokens. From here you can open external apps and the Audit log.

Members

Members shows name, email, role, status, and access groups. Search by name or email. For a selected user, an administrator can:

• change between Member and Administrator when workspace rules allow it
• suspend or reactivate the user
• open the access-group dialog and add or remove the user from custom groups

The owner cannot be changed from this dialog; ownership is handled through ownership transfer. You also cannot suspend yourself or the owner, demote the last administrator, or remove the last owner.

Invitations

Create an invitation with a personal or external email address, local part, optional mailbox domain, base role, delegated roles, and access groups. You can resend or revoke it.

The recipient must activate the invitation to receive access. Group selection in the invitation dialog is marked assigned on activation (coming soon) in the current interface. Do not document or plan this as immediate group provisioning until that status changes in Admin.

Common rejections occur when the user is already a member, an invitation already exists, the user limit has been reached, the mailbox is taken, the domain is not owned or active, or the inviting administrator attempts to grant a higher role than their own.

Access groups

The system groups Owners, Administrators, Users, and Guests are managed automatically and cannot be edited. Create custom groups for work, such as Finance, Sales, or Management. A group can have a parent group.

Groups are useful when several people need the same access to an app or service. Create the group, add members, and then check the access matrix before enforcing access in an external app.

Admin roles

The page shows the base roles Owner, Administrator, and Member, plus delegated roles such as User administrator, Security administrator, and Billing administrator. It shows human-readable descriptions and, when technical details are opened, the underlying permission keys.

An important current limitation: delegated roles currently provide read and visibility access where the interface says so. Full write enforcement for delegated roles is coming later. Do not use a delegated role as the only security barrier for a critical write action without verifying actual access.

Access overview

Access overview is a matrix with groups as rows and internal services or external apps as columns. A checkmark means that the group has access. A checkmark through All employees also applies to members of that group.

External apps can show access enforcement as:

• Off: the app lets users through without onmeil.eu stopping users who lack access
• Monitoring: onmeil.eu calculates who would be stopped but lets everyone through
• Enforced: only users with access to the app continue

Start with Monitoring, check the result, and then enable Enforced.

Apps and integrations

The Apps & integrations tab contains four subtabs.

Internal

This shows Meil’s own services and who has access. The service catalog and access view can be dynamic for the workspace, so check status and access in Admin before promising a specific service to a group.

Apps & SSO

You can create external apps with OpenID Connect (OIDC) or SAML 2.0.

OIDC

1. Choose OIDC and enter an app name.
2. Add one concrete redirect URI per line.
3. Use https://; wildcards are not allowed.
4. Choose All employees or selected access groups.
5. Create the app and copy the client ID and client secret.
6. Add the discovery URL or technical endpoints to the external app.

The client secret is shown only once. Store it in the external service’s secret manager before closing the dialog. Rotating it invalidates the old secret immediately.

SAML 2.0

Enter an app name, Entity ID, concrete HTTPS ACS URL, NameID format, and optional Single Logout URL. After creation, Admin shows the IdP metadata URL, IdP Entity ID, and SSO URL. onmeil.eu is the identity provider (IdP), and these values should be given to the service provider (SP).

Do not enforce access until a test user has completed sign-in and returned to the service.

Provisioning (SCIM)

SCIM connects an external identity system, such as Entra or Okta, to the workspace:

1. Copy the SCIM base URL from Admin.
2. Create a token with a descriptive name.
3. Copy the token while the dialog shows it and add it to the identity system.
4. Check last used, IP address, status, and any errors in the token list.

The token is shown only once. Rotate it when it must be replaced; the old value stops working immediately. Revoke it when the integration should no longer be able to write to SCIM.

Admin also shows active members against any seat limit. Set a limit before enabling automatic provisioning if the workspace has no seat limit.

Service catalog

The service catalog is read-only. It shows service names, features, plan availability, capacity limits, who can create them, owner system, status, and risk level. Show internal expands the list with internal entries. Use the catalog as the source of truth for what the workspace actually has, not as a control for changing access.

Settings

Under Settings, an administrator can save:

• the default role for new invitations: Member or Administrator
• whether members can find and start encrypted chats with active meil accounts outside the organization

The default-role setting applies when no role is selected in a new invitation. It does not change existing members.

Safe use

• Use concrete HTTPS redirect URIs, never wildcards.
• Treat OIDC and SCIM secrets like passwords.
• Use Monitoring before Enforced for external apps.
• Check groups and the access matrix before a broad change.
• Use the Audit log to confirm who created, changed, or removed access.
• Do not put tokens, client secrets, or SAML configuration in support tickets.