User & Data Management (UDM) Plus: setup – deskbird Help Center

UDM Plus

This guide walks you through setting up the User & Data Management (UDM) Plus add-on: single sign-on with SAML 2.0, your HRIS integration, user provisioning with SCIM and the visibility and privacy settings. Each step explains what the feature does for your team and links to the article with the detailed instructions. When you finish, users sign in with your identity provider, accounts and absences stay in sync automatically, and you control what colleagues can see about each other.

Before you start
Set up SSO with SAML 2.0
Connect your HRIS
Provision users with SCIM
Set visibility and privacy
More options
FAQs

1. Before you start

The steps in this guide need the UDM Plus add-on. If your contract includes an older UDM plan, the same steps apply. Sign-in with Microsoft or Google is available on every plan and doesn't need UDM Plus. For an overview, see Feature Availability.

Role: you need the Global administrator role in deskbird. See System roles and permissions.
Identity provider: admin access to your identity provider (for example Okta, Microsoft Entra ID or Keycloak), to create the SAML and SCIM applications.
HRIS: API credentials generated in your HRIS, with read access to employees and absences.
One source for user accounts: decide whether SCIM (from your identity provider) or your HRIS creates and deactivates users, so accounts are not managed from two places.

The steps are ordered by how often teams ask about them. You can set them up in any order, but set up SSO and user provisioning before you invite users, so nobody creates a separate email and password account first.

2. Set up SSO with SAML 2.0

With SAML 2.0, users sign in to deskbird with the account they already use at work, and you manage access centrally in your identity provider. deskbird works with any SAML 2.0 identity provider and supports SP-initiated sign-in, so sign-in always starts from deskbird.

In your identity provider, create a SAML application with the deskbird service provider details and map the user's email address as the NameID. See SSO with SAML 2.0: Setup of SAML 2.0 Federation.
Add the user attributes you want deskbird to receive. Only email is required; first and last name are recommended.
Send the metadata file (or the IdP Entity ID, SSO URL and certificate) to deskbird support. We configure the connection on our side and confirm when it is ready.
Test the sign-in with a test user from the deskbird login screen.

Step-by-step guides for specific identity providers: SSO with Okta and SSO with Keycloak. To compare all sign-in methods, see Login options overview.

⚠️ Important: SAML certificates expire, typically after 1 to 3 years. Start the renewal 2 to 3 weeks before the expiry date to avoid a sign-in outage. See SAML certificate renewal.

3. Connect your HRIS

With the HRIS integration, approved absences such as holidays and sick days appear automatically as "Absent" on the Plan page. Your team doesn't have to track them twice, and their bookings on those days are canceled (meeting room bookings stay). deskbird supports more than a dozen HRIS tools, including Personio, HiBob, BambooHR, Workday and SAP SuccessFactors. We deliver these integrations together with our partner Merge.

Generate API credentials in your HRIS.
Go to Admin > Company: Integrations, select your HRIS and enter the credentials. Follow the on-screen steps.
Make sure Absences is turned on. deskbird then syncs all future absences and approved absences from the past 3 months.
To also create users and groups from your HRIS, turn on Organization sync (see More options). Absences and users can be synced separately or together.

Full instructions and the list of supported tools: HRIS Integration: Absences. Which absences are synced, and how half days work: HRIS Integration - FAQ.

💡 Tip: The HRIS sync runs on a schedule, not in real time, so a change in your HRIS shows up in deskbird after the next sync. If something is missing after that, see HRIS troubleshooting.

4. Provision users with SCIM

SCIM creates, updates and deactivates deskbird users automatically from your identity provider. New employees get access without manual work, group changes come through, and people who leave lose access when you remove them in your identity provider.

Go to Admin > Company settings > API keys and generate a SCIM key. Your company has one SCIM key, and it is shown only once, so copy it to a safe place.
In your identity provider, create a provisioning application with the deskbird SCIM URL and your SCIM key. See SCIM 2.0 Entra ID setup guide or SCIM with Okta.
Assign only the users and groups who need deskbird. Everyone in the assignment is provisioned automatically.
Start provisioning. The first sync can take 1 to 2 hours.

How SCIM works in deskbird: SCIM Overview.

💡 Tip: Users created through SCIM don't get an invitation email. Let your team know when deskbird is ready and share How to log in to deskbird with them.

5. Set visibility and privacy

The visibility and privacy settings decide how much users and groups can see of each other, for example whether people can find colleagues outside their own department, and whether users can make their profile private.

Go to Admin > User management: Visibility & privacy.
Under Visibility settings, choose who users can find (User visibility) and which groups they can see (Group visibility).
Under Privacy settings, choose whether users can have Private profiles, and which profile type new users get by default.
Click Save. Changes take effect immediately.

What each option means, and how it affects each role: Visibility and privacy settings (users and groups). What users see on their side: Your privacy in deskbird.

💡 Tip: Most companies keep the defaults (all users visible, no private profiles), because colleagues can then find each other and plan office days together. Restrict visibility only if your organization needs to separate departments.

6. More options

Fewer companies need these, but they are part of UDM Plus:

SFTP for absences (on request): if your HRIS isn't supported, deskbird can sync absences from a CSV file that you upload via SFTP. This method covers absences only, not users or groups. See HRIS Integration: Absences: SFTP setup.
Users and groups from your HRIS: instead of SCIM, your HRIS can create and deactivate users and sync teams, departments and reporting lines as groups. See HRIS Integration: Users and Groups.

7. FAQs

No. Sign-in with Microsoft or Google works on every plan and needs no certificate management. SAML 2.0 is for companies that use another identity provider, such as Okta, Keycloak or ADFS, or that want to manage deskbird access through a SAML application. See When to use SAML vs. OAuth / OIDC.

Pick one of them, so users are not created or deactivated from two places:

SCIM suits companies that manage app access in their identity provider (for example Microsoft Entra ID or Okta). Your identity provider pushes changes to deskbird in its provisioning cycle.
HRIS user sync suits companies whose HRIS is the source of truth for employees. It runs on a schedule.

The HRIS absence sync and the HRIS user sync are independent: you can sync absences only, users only, or both. So you can use SCIM for users and still connect your HRIS for absences.

No. Invitation emails are only sent to users you invite manually. Tell your team when they can start, and point them to How to log in to deskbird.

Check that the NameID is the user's email address and matches the email of their deskbird user.
Check that users start the sign-in from deskbird. Sign-in from an identity provider tile only works through a bookmark app (see Setup of SAML 2.0 Federation).
Check that the SAML certificate in your identity provider is active and not expired.
If it works on the web but not in the mobile app, see Mobile app: SSO login failures.

Set up SSO and SCIM (or the HRIS user sync) before users start signing in, and make sure the email address in your identity provider or HRIS matches the one in deskbird. Once everything works, consider turning off email and password sign-in in Admin > Company: General settings > Authentication, so everyone signs in through your identity provider (see General settings: Authentication). See also Duplicate accounts.

For absences, deskbird can set up an SFTP sync on request: you upload a CSV file with your absences, either manually or with a scheduled job. Contact your Customer Success Manager to discuss it. For user accounts, use SCIM from your identity provider instead.

With SCIM, a user you remove from the provisioning scope is set to inactive in the next provisioning cycle. Inactive users can't sign in or book, and they don't count toward your license (see SCIM troubleshooting). With the HRIS user sync, an employee set to inactive or terminated in your HRIS is deactivated in deskbird, their upcoming bookings are canceled and assigned desks are released. For the difference between deactivating and deleting an employee in your HRIS, see HRIS Integration: Users and Groups: FAQs.