Click Directory Synchronization Client to use an LDAP directory.

Click SCIM Integration (cloud web only) to use a cloud-based identity provider.

Because you are provisioning user and group data, you can manage policy membership through group membership. Select from the Default user policy drop-down the web policy to which you want to assign users if they have no group-based policy assignment already. By default, the first policy in the list is chosen.

Select Overwrite groups to overwrite current groups with the provisioned groups when there is a group name conflict.

Specify whether you want the User policy assignment to be fixed after the initial user provisioning, or if you want the service to check the group policy membership every time users are provisioned or group policy assignments are changed in the cloud.

Select Fixed if you want to manage policy assignments in the cloud. When this option is selected, the service makes a policy assessment for an individual user only when that user first appears in the system (in other words, is synchronized for the first time). It either assigns the user a group-based policy or the default policy specified above. If you want to move someone to a new policy, you need to do so in the cloud.

Select Follow group membership if you want users' policy assignments to change automatically when there are changes to their group membership. If you move someone to another group, he or she moves to a different policy. This is the default.

Select one of the Email settings radio buttons to indicate whether you want email sent to new end users to notify them that they are now protected by the cloud service.

Choose which Email template you want to use to notify end users of their enrollment in the cloud service. Initially, only the default message is offered, but you can create custom notifications if desired. See Configure block and notification pages for more information.

For Sender's address, enter the address from which you want notification messages sent to new users.

(Quarantine/discard/bounce) mail for unknown users. This determines what happens to email arriving at the cloud service that is sent to an unknown email address. By default it is quarantined.

The Base URL is used to allow your identity provider to access the cloud service. Use the copy option provided to easily paste the URL into the appropriate configuration page for your provided.

The Bearer token provides an unique authentication key used to authorize requests to the cloud service. Click Generate New Token to generate the key and then use it when configuring your identity provider.