Can I specify the org to create a user in if they don't already exist and I'm logging in SAML IDP?

I'm trying to integrate an external SAML IDP (mock saml) and the user keeps getting created in the default organization. Is there a way to create the user in a different org if they don't already exist?

Self Hosted: v4.4.0

nullsenseOP•11/19/25, 11:10 PM

@Ask Inkeep

Ask Inkeep•11/19/25, 11:10 PM

Thanks for tagging me @nullsense. I'll look through relevant sources and get back to you shortly.

Ask Inkeep•11/19/25, 11:10 PM

Answer

When a user authenticates via an external SAML IdP, they are created in the default organization by default (1) . To create users in a different organization, you need to send the organization scope in your authorization request (1) (2) .

The organization scope format is: urn:zitadel:iam:org:id:{id}urn:zitadel:iam:org:id:{id}

By including this scope in the auth request, you can specify which organization the user should be registered to (2) . The login and registration form will be tied to the organization specified in this scope rather than the default organization (1) .

This approach allows you to control which organization users from your MockSAML IdP are created in when they don't already exist in ZITADEL.

Ask Inkeep•11/19/25, 11:10 PM

To learn more, see the sources I considered:

[1] Discord message from @camoseth on 2024-12-13
[2] Registering a new user via dialog, not via management UI always picks the default org

Ask Inkeep•11/19/25, 11:10 PM

Feel free to tag @Ask Inkeep with additional questions.

nullsenseOP•11/19/25, 11:26 PM

@Ask Inkeep How do I reach the Zitadel UI Console that is specific for one f my organizations

Ask Inkeep•11/19/25, 11:26 PM

Thanks for the follow-up, @nullsense. I'll get back to you soon.

Ask Inkeep•11/19/25, 11:27 PM

Answer

To access the ZITADEL Console for a specific organization, you can access it by calling: ${CUSTOM-DOMAIN}/ui/${CUSTOM-DOMAIN}/ui/ (1) .

Once you're in the Console, you can switch between organizations using the dropdown in the header (2) (1) . Click the dropdown in the header and select the organization you want to manage . When you click on an organization in the list, you will switch your context to that organization (1) .

The Console allows you to manage all your resources through the UI .

Ask Inkeep•11/19/25, 11:27 PM

To learn more, see the sources I considered:

[1] Onboard B2B customers using organizations
[2] ZITADEL Organizations

Ask Inkeep•11/19/25, 11:27 PM

Feel free to tag @Ask Inkeep with additional questions.

nullsenseOP•11/19/25, 11:27 PM

@Ask Inkeep The Zitadel UI login screen only shows IDP login for the default organization. Is there a way to scope the UI for a specific organization instead?

Ask Inkeep•11/19/25, 11:27 PM

Thanks for the follow-up, @nullsense. I'll get back to you soon.

Ask Inkeep•11/19/25, 11:27 PM

Answer

Yes, you can scope the ZITADEL login UI to show a specific organization's settings and IdPs by sending the organization scope in your authorization request (1) (2) (3) .

The organization scope format is: urn:zitadel:iam:org:id:{orgID}urn:zitadel:iam:org:id:{orgID} (1) (2)

When you include this scope in the auth request, ZITADEL will render the login UI with the settings from the specified organization, including that organization's configured Identity Providers (3) . This tells ZITADEL which organization's login UI you want to see, and the settings are triggered from the requested organization .

Without this scope, the login screen shows settings from the default organization (4) . However, once a username is entered, ZITADEL can identify the user's organization and switch the login context to show that organization's settings (1) (3) .

For your MockSAML IdP integration, make sure the IdP is configured at the organization level (not just instance level) , and include the organization scope when redirecting users to the login UI questions-help-bugsWe have configured Google and MS as external IDP, but these buttons do now show up at login .

Ask Inkeep•11/19/25, 11:27 PM

To learn more, see the sources I considered:

[1] Let Users Login with Preferred Identity Provider
[2] Users of one organization by default shouldn't be allowed to log in other organizations
[3] Discord message from @mdnmdn on 2024-03-11
[4] Technical Advisory 10003
questions-help-bugsWe have configured Google and MS as external IDP, but these buttons do now show up at login

Ask Inkeep•11/19/25, 11:27 PM

Feel free to tag @Ask Inkeep with additional questions.

nullsenseOP•11/19/25, 11:58 PM

How do I show the external IDP on the login screen for an organization that is not the default. @Ask Inkeep

Ask Inkeep•11/19/25, 11:58 PM

Thanks for the follow-up, @nullsense. I'll get back to you soon.

Ask Inkeep•11/19/25, 11:59 PM

Answer

To show the external IdP on the login screen for a non-default organization, you need to do two things: (1) (2)

Configure the IdP at the organization level
(3)

When you configure an IdP at the instance level, it won't automatically be linked to users in specific organizations . You need to configure the IdP directly on the organization where you want it to appear (1) (3) .

Go to your organization settings and add the Identity Provider there (1) . Navigate to the organization's settings page and select "Identity Providers" (1) (4) (5) .

Send the organization scope in your authorization request
(1) (2)

Include this scope in your auth request:

urn:zitadel:iam:org:id:{id}

urn:zitadel:iam:org:id:{id}

Ask Inkeep•11/19/25, 11:59 PM

By sending this scope, you tell ZITADEL which organization's login settings to display (1) . The login and registration form will then show the IdPs configured for that specific organization rather than the default organization (2) .

Without this scope, ZITADEL defaults to showing the login page for the default organization . The organization scope ensures the correct IdP options appear on the login screen (1) (2) .

**

Ask Inkeep•11/19/25, 11:59 PM

To learn more, see the sources I considered:

[1] Let Users Login with Preferred Identity Provider
[2] Discord message from @camoseth on 2024-12-13
[3] External IdP is not linked to users if IdP is configured on instance level
[4] Configure Entra ID as an Identity Provider in ZITADEL
[5] Configure Apple as an Identity Provider in ZITADEL

Ask Inkeep•11/19/25, 11:59 PM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] Let Users Login with Prefer...

Ask InkeepAPP•11/20/25, 12:03 AM

Got it. Tagging @Rajat for additional help.

nullsenseOP•11/20/25, 12:46 AM

Hey Rajat,
I'm confused about how to include the scope that's being suggested in the answer above when I'm just being served the default login screen (for the default org). I'm having trouble getting external IDPs in non-default orgs to load on this screen because of that.

AAsk Inkeep To learn more, see the sources I considered: [[1] Let Users Login with Prefer...

Ask InkeepAPP•11/20/25, 9:38 PM

Glad I could be helpful. Feel free to create a new thread with any new questions you may have.