Connect Okta, Google Workspace, Microsoft Entra ID, or JumpCloud
Connect Okta, Google Workspace, Microsoft Entra ID, or JumpCloud with read-only scopes to discover the software your team actually uses.
Supported identity providers
Cubbie connects to four identity providers to discover the software your team actually uses:
- Okta
- Google Workspace
- Microsoft Entra ID
- JumpCloud
What Cubbie reads
Connections are read-only. Cubbie requests only read scopes — for example, the Okta connection uses okta.users.read, okta.apps.read, and okta.logs.read. With those scopes Cubbie reads:
- The list of apps assigned in your identity provider
- Active user counts and licensed seat counts per app
- Last-activity timestamps
Cubbie never reads passwords, message content, or files, and it cannot change anything in your identity provider.
Connect a provider
1. Open Subscriptions in your dashboard and find the Integration connectors section.
2. Choose your provider and enter what it asks for:
- Google Workspace: your Workspace domain (for example company.com), then approve the consent screen as a Workspace admin.
- Okta: your Okta domain (for example https://company.okta.com) plus the Client ID and Client secret of an API Services app. Create that app in the Okta Admin Console under Applications > Create App Integration > API Services, and grant it okta.users.read, okta.apps.read, and okta.logs.read under Okta API Scopes. There is no consent screen; Cubbie checks the credentials once and stores them encrypted.
- Microsoft Entra ID: your tenant ID, found under Microsoft Entra ID > Overview in the Azure portal, then approve the consent screen as a Global Administrator.
- JumpCloud: an API key generated in the JumpCloud Admin Portal under your admin profile (My API Key). A Read Only administrator role is enough, and Directory Insights must be part of your plan. Cubbie checks the key once, stores it encrypted, and never shows it again.
3. Run a sync. Discovered apps flow into your subscription registry, where you confirm or correct them.
If a provider card shows "By request" instead of Connect, that provider is being enabled for workspaces by our team. Use Request access on the card and we will set it up with you.
Sync status and history
Each connection shows its status (connected, error, or revoked) and the result of the most recent sync, so expired credentials and partial syncs are easy to spot. A sync that fails for a passing reason keeps the connection and retries on its own; only lost or refused credentials end a connection, and reconnecting fixes that.
Disconnect or revoke
From the same Integration connectors section, use Disconnect on a connection to revoke access. Cubbie stops syncing immediately. Registry records that were already imported stay — they are your data — but usage signals stop updating. You can reconnect the same provider later without starting over. For Okta and JumpCloud, reconnecting with new credentials is how you rotate them.
Looking for SSO login instead?
This article covers stack discovery. If you want your team to sign in to Cubbie itself through your identity provider, see the SAML SSO and SCIM article instead — that is a separate setup under your buyer org settings.