This page is the starting point for identity and access in Flip. It explains what Frontline Identity does, how it fits next to your existing identity infrastructure, and which article to read for each task. Not every capability described here is enabled for every organization; each article states its own requirement.
Frontline Identity is the identity layer Flip provides for employees who have no corporate email address, no managed device, and no PC workplace. It covers how those employees get an account, prove who they are, and sign in.
It is designed to run alongside your existing identity infrastructure, not to replace it. In a typical setup your enterprise directory or HR system remains the system of record for employee data, your existing identity provider continues to serve office employees, and Frontline Identity handles activation and sign-in for the frontline workforce.
What Flip holds and what your systems keep
| Concern | Typically owned by | Notes |
|---|---|---|
| Employee master data (system of record) | Your HR system or enterprise directory | Flip replicates the attributes it needs. It does not read through to a source system at sign-in time. |
| Minimum attribute set stored in Flip | Flip | First name, last name, and username. You decide which further attributes to send. |
| Office employee authentication | Your existing identity provider | Unchanged by Frontline Identity. |
| Frontline activation and authentication | Flip | Account activation, sign-in methods, credential recovery. |
| Group membership and in-app access | Flip | Driven by attributes you sync from your systems. |
| Authentication audit trail | Flip | Available as authentication events and audit logs. |
Two integration directions
This is the most useful distinction when you plan a rollout. The two directions are independent, and most organizations end up using both.
Inbound: your identity system into Flip. Users and their attributes flow from your enterprise directory or HR system into Flip, and employees who do have a corporate account can sign in to Flip through your existing identity provider. Set this up with SCIM provisioning and single sign-on.
Outbound: Flip into your other applications. Flip acts as the identity provider for other applications, so employees sign in to them with their Flip credentials and no separate login. Flip supports both OIDC and SAML for this. You create and manage OIDC clients yourself in the Admin Console. For SAML, contact your Customer Success Manager with the details of the application you want to connect, and Flip sets the client up for you.
Decide the inbound direction first. It determines where accounts come from, which in turn determines what your activation process has to cover.
Reading path by task
Connect your identity system
| Task | Article |
|---|---|
| Decide where accounts come from | Choose a provisioning path for your users |
| Provision users and attributes over SCIM | Connect SCIM with your Identity System |
| Look up SCIM endpoint and attribute details | SCIM API Documentation |
| Import employee master data | How can I import master data into the app? |
| Set up single sign-on with Microsoft Entra ID | OIDC: How to set up Microsoft Entra ID · SAML: How to setup Microsoft Entra ID · SSO (Single-Sign-On) |
Accounts and activation
| Task | Article |
|---|---|
| Activate employees who have no corporate email address | Activate a user with an invite code or QR code |
| Let team leads activate their own people | Activate a team member with a QR code |
| Create, edit, lock, and delete individual accounts | Create, edit, lock and delete users |
| Create or change many accounts at once | Add users with the Excel import · Change user data/channel membership with the Excel import · Deleting users with the Excel import |
| See who has not signed in yet | Display who has not logged in to the app yet |
| Reset an employee's password on their behalf | Reset passwords of users |
| Hand employees an installation guide | How can I independently provide the installation guide for my users? |
| Understand the states an account moves through | User Account Lifecycle |
| Understand what deletion removes and what is retained | User Deletion Concept |
Attributes, groups and roles
| Task | Article |
|---|---|
| Define which attributes exist on a profile | Create, configure and delete User Attributes (Profile Fields) |
| Understand and set up user groups | User groups · Getting Started with User Groups |
| Assign group membership automatically from attributes | Automated User Group Assignments (User Group Rules) |
| Assign roles to accounts | Set roles for user accounts |
| See what a system administrator can do | Roles and rights as a system administrator |
Sign-in, security and audit
| Task | Article |
|---|---|
| Choose and roll out passkeys | Roll out passkeys in your organization |
| Sign in with a certificate, including on shared devices (not generally available) | Certificate-based authentication |
| Let another application use Flip for sign-in | Managing OIDC clients in the Admin Console |
| Review who changed what, and when | Review Identity Events in the Audit Logs |
| Review who signed in, when, and how | Authentication Events |
| Create credentials for machine-to-machine API access | Create and manage API clients |
| Work out why a cross-device passkey sign-in fails behind a proxy | Cross-device passkey sign-in behind a proxy |
Hand these to your employees
| Topic | Article |
|---|---|
| Signing in without a password | Passkeys in Flip: sign in securely without a password |
| Two-factor authentication | Two-factor authentication (2FA) |
| Sign-in problems | I cannot log in. What can I do? |
| Resetting their own password | How can I reset my password? |
What is not on this page
- Building an application against Flip's APIs. Developer documentation, including endpoint references and code examples, is at getflip.dev.
- Configuring communication and operations features. Channels, news, forms, and mini apps are covered in the other For Administrators sections.