This page is the starting point for identity and access in Flip. It explains what Frontline Identity does, how it fits next to your existing identity infrastructure, and which article to read for each task. Not every capability described here is enabled for every organization; each article states its own requirement.
Frontline Identity is the identity layer Flip provides for employees who have no corporate email address, no managed device, and no PC workplace. It covers how those employees get an account, prove who they are, and sign in.
It is designed to run alongside your existing identity infrastructure, not to replace it. In a typical setup your enterprise directory or HR system remains the system of record for employee data, your existing identity provider continues to serve office employees, and Frontline Identity handles activation and sign-in for the frontline workforce.
What Flip holds and what your systems keep
| Concern | Typically owned by | Notes |
|---|---|---|
| Employee master data (system of record) | Your HR system or enterprise directory | Flip replicates the attributes it needs. It does not read through to a source system at sign-in time. |
| Minimum attribute set stored in Flip | Flip | First name, last name, and username. You decide which further attributes to send. |
| Office employee authentication | Your existing identity provider | Unchanged by Frontline Identity. |
| Frontline activation and authentication | Flip | Account activation, sign-in methods, credential recovery. |
| Group membership and in-app access | Flip | Driven by attributes you sync from your systems. |
| Authentication audit trail | Flip | Available as authentication events. |
Which additional attributes you send is driven by what you want to do with them. Automated group rules need an organizational code; passing data through to a downstream system needs the attributes that system expects; self-service credential recovery needs a contact channel.
Two integration directions
This is the most useful distinction when you plan a rollout. The two directions are independent, and most organizations end up using both.
Inbound: your identity system into Flip. Users and their attributes flow from your enterprise directory or HR system into Flip, and employees who do have a corporate account can sign in to Flip through your existing identity provider. Set this up with SCIM provisioning and single sign-on.
Outbound: Flip into your other applications. Flip acts as the identity provider for other applications, so employees sign in to them with their Flip credentials and no separate login. Flip supports both OIDC and SAML for this. You create and manage OIDC clients yourself in the Admin Console. For SAML, contact your Customer Success Manager with the details of the application you want to connect, and Flip sets the client up for you.
Decide the inbound direction first. It determines where accounts come from, which in turn determines what your activation process has to cover.
Reading path by task
Connect your identity system to Flip
| Task | Article |
|---|---|
| Provision users and attributes from your identity system | Connect SCIM with your Identity System |
| Look up SCIM endpoint and attribute details | SCIM API Documentation |
| Enable single sign-on for the Flip app | Enabling Single-Sign-On for your Flip app |
| Configure Microsoft Entra ID as the identity provider | How to set up Azure AD |
| Grant the required Graph API permissions | Granting access to the Graph API |
| Scope which Entra groups are synced | Setting up dedicated Entra ID groups for Flip |
| Manage synced users and groups on the Entra side | Managing users and user groups in Azure |
| Troubleshoot the sync | Flip Syncer FAQ |
| Sync users and channels programmatically | The Flip Sync API for users and channels |
Use Flip as the identity provider for other applications
| Task | Article |
|---|---|
| Let another application use Flip for sign-in over OIDC | Not yet published |
| Let another application use Flip for sign-in over SAML | Contact your Customer Success Manager. SAML clients are set up for you. |
| Choose which sign-in methods employees can use | Not yet documented |
Accounts and activation
| Task | Article |
|---|---|
| Create, edit, lock, and delete individual accounts | Create, edit, lock and delete users |
| Create many accounts from a spreadsheet | Add users with the Excel import |
| Change user data or channel membership in bulk | Change user data/channel membership with the Excel import |
| Delete accounts in bulk | Deleting users with the Excel import |
| Import employee master data | How can I import master data into the app? |
| Understand the states an account moves through | User Account Lifecycle |
| Understand what deletion removes and what is retained | User Deletion Concept |
| Reset an employee's password on their behalf | Reset passwords of users |
| Hand employees an installation guide | How can I independently provide the installation guide for my users? |
| Activate employees who have no corporate email address | Not yet documented |
| Let managers activate their own team members | Not yet documented |
Attributes, groups, and permissions
| Task | Article |
|---|---|
| Define which attributes exist on a profile | Create, configure and delete User Attributes (Profile Fields) |
| Understand what user groups are and when to use them | User groups · Getting Started with User Groups |
| Assign group membership automatically from attributes | Automated User Group Assignments (User Group Rules) |
| Control channel access by group | How to add channels based on user groups? |
| Control menu items by group | How to create, manage and delete menu items based on user groups? |
| See what a system administrator can do | Roles and rights as a system administrator |
| Assign roles to accounts | Set roles for user accounts |
| Report on group coverage | Analytics – User Groups |
Security and audit
| Task | Article |
|---|---|
| Review who signed in, when, and how | Authentication Events |
| Create credentials for machine-to-machine API access | Create and manage API clients |
Hand these to your employees
| Topic | Article |
|---|---|
| Signing in without a password | Passkeys in Flip: sign in securely without a password |
| Two-factor authentication | Two-factor authentication (2FA) |
| Sign-in problems | I cannot log in. What can I do? |
| Resetting their own password | How can I reset my password? |
What is not on this page
- Building an application against Flip's APIs. Developer documentation, including endpoint references and code examples, is at getflip.dev.
- Configuring communication and operations features. Channels, news, forms, and mini apps are covered in the other For Administrators sections.