Going live

Steps

#	Who	Step
1	Your team	Tell your Retorio contact the method, your identity provider product and the Retorio organizations it covers
2	Retorio	Sets up your organization and sends the SAML entity ID where needed
3	Your team	Creates the application with the setup values, assigns a test user and sends back the details
4	Retorio	Connects your provider and switches your organization to single sign-on. From then on, users who signed in with email and password sign in through your provider
5	Together	Invite the test user into a cohort and sign in once with the login link. Retorio confirms what your provider sent
6	Together	Invite everyone else through the admin app or the API, and assign them to the application in your provider

Invitation emails still go out. Invited users receive an invitation email, with single sign-on or without. Brief them before a bulk rollout. Invitations expire after 60 days.

Joiners and leavers

Retorio does not read your directory, so access is managed in two places: your identity provider, and Retorio through the admin app or the API.

Event	In your identity provider	In Retorio
Joiner	Assign them to the application	Invite them into a cohort
Team change	No change needed	Change their cohort
Leaver	Disable or unassign them. This stops new sign-ins	Remove them from the organization. This ends their access and removes their conversations and results

Remove leavers in Retorio too. Disabling someone in your identity provider does not end a Retorio session that is already open. Removing them from the organization in Retorio does, from their next request.