Team docs accuracy audit: corrections and third-party verification

src/components/NavigationDocs.jsx

@@ -350,12 +350,48 @@ export const docsNavigation = [
                         title: 'Single Sign-On',
                         href: '/manage/team/single-sign-on',
                         isOpen: false,
-                        //                        links: [
-                        //                            { title: 'Authentik', href: '/manage/team/single-sign-on/authentik' },
-                        //                            { title: 'Keycloak', href: '/manage/team/single-sign-on/keycloak' },
-                        //                            { title: 'Auth0', href: '/manage/team/single-sign-on/auth0' },
-                        //                            { title: 'JumpCloud', href: '/manage/team/single-sign-on/jumpcloud' },
-                        //                        ]
+                        links: [
+                            {
+                                title: 'Authentik',
+                                href: '/manage/team/single-sign-on/authentik',
+                            },
+                            {
+                                title: 'Keycloak',
+                                href: '/manage/team/single-sign-on/keycloak',
+                            },
+                            {
+                                title: 'JumpCloud',
+                                href: '/manage/team/single-sign-on/jumpcloud',
+                            },
+                            {
+                                title: 'Auth0',
+                                href: '/manage/team/single-sign-on/auth0',
+                            },
+                            {
+                                title: 'Duo Security',
+                                href: '/manage/team/single-sign-on/duo-security',
+                            },
+                            {
+                                title: 'Zitadel',
+                                href: '/manage/team/single-sign-on/zitadel',
+                            },
+                            {
+                                title: 'cidaas',
+                                href: '/manage/team/single-sign-on/cidaas',
+                            },
+                            {
+                                title: 'AWS Cognito',
+                                href: '/manage/team/single-sign-on/aws-cognito',
+                            },
+                            {
+                                title: 'Zoho',
+                                href: '/manage/team/single-sign-on/zoho',
+                            },
+                            {
+                                title: 'IIJ ID',
+                                href: '/manage/team/single-sign-on/iij-id',
+                            },
+                        ],
                     },
                 ],
             },

src/pages/manage/team/add-users-to-your-network.mdx

@@ -35,6 +35,8 @@ As the name stands, this way of inviting users is straightforward and works thro
 To invite a new user, proceed to `Team` then select the `Users` tab and click the <button name="button" className="button-6">Invite User</button> button.
 A window will appear, allowing you to specify the name and email address of the user you want to invite. Optionally, you could select a set of groups with which you want this user to be associated.
 
+On a self-hosted installation the same button reads `Add User`, and it only appears when [local user management](/selfhosted/identity-providers/local) is enabled. If you have [disabled local authentication](/selfhosted/identity-providers/disable-local-authentication), the button is disabled and users have to come from your IdP instead.
+
 The invited users will receive an email invitation that they have to confirm.
 After logging in to the system, they will join your network automatically.
 
@@ -43,15 +45,14 @@ After logging in to the system, they will join your network automatically.
 </p>
 
 <Note>
-    If a user already has a NetBird account, you can't invite them.
-    This is a limitation that is likely to be removed in future versions.
+    If a user already has a NetBird account, you can't invite them. The invite is rejected with
+    `can't invite a user with an existing NetBird account`.
 </Note>
 
 ## Identity Provider (IdP) Sync
 
 NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically
-provisioning users and groups. You can enable this feature from the `Users` tab by clicking the `Identity Provider Sync`
-button.
+provisioning users and groups. You configure it from the `Integrations` page, on the `Identity Provider Sync` tab.
 
 <p>
     <img src="/docs-static/img/manage/team/idp-sync-reference.png" alt="idp-sync-reference" className="imagewrapper"/>

src/pages/manage/team/approve-users.mdx

@@ -14,13 +14,31 @@ Navigate to the Dashboard's `Settings` page and the `Authentication` tab and ena
     <img src="/docs-static/img/manage/team/approve-users/netbird-authentication-settings-approval.png" alt="netbird-authentication-settings-approval" className="imagewrapper-big"/>
 </p>
 
+## What a pending user sees
+Until an administrator approves them, the user can sign in but can't reach the dashboard. They get a
+`User Approval Pending` screen telling them their account is pending approval from an administrator.
+They hold the `Pending` status in the `Users` table until you act on them.
+
 ## Approve or reject user
 To approve a user, navigate to the [Users Page](https://app.netbird.io/team/users) and click the `Approve` or `Reject` button on the right side of the users table.
 
 <p>
     <img src="/docs-static/img/manage/team/approve-users/netbird-user-approval.png" alt="netbird-user-approval" className="imagewrapper-big"/>
 </p>
 
+When several people are waiting, the `Pending Approval` button above the table filters it down to just
+those users, and carries a badge with the number outstanding. The button only appears while at least one
+user is waiting.
+
+<Note>
+    `Reject` is permanent. It removes the user from the account and can't be undone. Use `Block` instead
+    if you want to keep the user on the account but deny access.
+</Note>
+
+The `Approve` and `Reject` buttons only render for roles that can update users, which means `Owner` and
+`Admin`. A `Network Admin` has read-only access to the `Team` tab and won't see them. See
+[User Roles](/manage/team/user-roles) for the full breakdown.
+
 ## Get started
 <div>
     <Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>

src/pages/manage/team/auto-offboard-users.mdx

@@ -1,6 +1,6 @@
 # Automatically Offboard Team Members from NetBird
 
-[NetBird's IdP-Sync integration](https://docs.netbird.io/manage/team/idp-sync) simplifies offboarding team members, enhancing
+[NetBird's IdP-Sync integration](/manage/team/idp-sync) simplifies offboarding team members, enhancing
 security and efficiency. With this integration, you can automatically revoke access when users leave the company, when
 temporary access for a freelancer ends after project completion, or when a seasonal employee's contract concludes.
 Likewise, you can use this integration to restrict access to specific resources or environments when a project finishes.
@@ -14,7 +14,7 @@ that `user_01` is part of the `IT Administrators` group, while `user_02` and `us
 
 ![NetBird Users](/docs-static/img/manage/team/auto-offboard-users/GT3eAeU.png)
 
-To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](https://docs.netbird.io/manage/team/idp-sync/microsoft-entra-id-sync).
+To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](/manage/team/idp-sync/microsoft-entra-id-sync).
 
 Next, locate the user you want to offboard in your IdP's user management section. Let’s say you want to revoke access to
 `user_01`, in that case, you will need to select it and click the `Delete` button as shown below.
@@ -25,7 +25,9 @@ After deletion, click the `Refresh` button to confirm that the user is no longer
 
 ![IdP Confirm Deletion](/docs-static/img/manage/team/auto-offboard-users/LJ6QHRV.png)
 
-Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to the `Integrations` screen in the NetBird admin console and click the corresponding integration button to manually trigger the synchronization.
+Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to `Integrations` in the NetBird dashboard, open the `Identity Provider Sync` tab, and trigger the synchronization manually.
+
+Manual sync is only available for the API-based integrations, Google Workspace and Microsoft Entra ID via API, because NetBird pulls from those providers. SCIM-based integrations such as Okta, JumpCloud, Keycloak, and IIJ ID are push-based: the provider sends changes to NetBird, so there is nothing to trigger from the NetBird side and deprovisioning lands as soon as your IdP pushes it.
 
 ![NetBird Integrations Force Sync](/docs-static/img/manage/team/auto-offboard-users/ogiiUeT.png)
 
@@ -45,6 +47,6 @@ Let's say the current project is finished, and you no longer want members of the
 ![IdP Delete Group](/docs-static/img/manage/team/auto-offboard-users/TOZjFKC.png)
 
 Once the changes synchronize in NetBird, users and their group memberships will be updated; therefore,
-[network access associated with that group](https://docs.netbird.io/manage/access-control/manage-network-access) will automatically be revoked.
+[network access associated with that group](/manage/access-control/manage-network-access) will automatically be revoked.
 
 ![NetBird No Group](/docs-static/img/manage/team/auto-offboard-users/NKabmN6.png)

src/pages/manage/team/entra-id-app-enablement.mdx

@@ -2,7 +2,7 @@ import {Note} from "@/components/mdx";
 
 # Enable NetBird for Microsoft Entra ID
 
-Before your organization can use Microsoft Entra ID features with NetBird — such as user provisioning, group sync, or single sign-on — you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent.
+Before your organization can use Microsoft Entra ID features with NetBird, such as user provisioning, group sync, or single sign-on, you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent.
 
 ## Prerequisites
 

src/pages/manage/team/idp-sync/embedded/keycloak-sync.mdx

@@ -2,7 +2,7 @@ import {Note} from "@/components/mdx";
 
 # Provision Users and Groups From Keycloak (Embedded IdP)
 
-Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO),
+Keycloak is an open source identity and access management solution that provides features like single sign-on (SSO),
 multi-factor authentication (MFA), user federation, and centralized identity management to help organizations
 secure and manage access to their applications and resources.
 

src/pages/manage/team/idp-sync/index.mdx

@@ -20,18 +20,53 @@ or update network configurations like [DNS](/manage/dns#distribution-groups),
 eliminating the need for manual grouping.
 
 <Note>
-    This feature is only available in the cloud version of NetBird in the [Team plan](https://netbird.io/pricing) and above.
+    IdP-Sync is available on NetBird Cloud in the [Team plan](https://netbird.io/pricing) and above. It is also
+    available on self-hosted deployments running a [Commercial License](https://netbird.io/pricing#on-prem) with the
+    embedded IdP, which use a separate set of setup guides listed under Self-hosted.
 </Note>
 
 This video guide walks you through an example integration with Microsoft Entra ID, covering both user onboarding and
 offboarding scenarios:
 
 <YouTube videoId="RxYWTpf7cgY" />
 
+## How syncing works
+
+NetBird syncs in one of two directions, and which one you get depends on the provider.
+
+**Pull, over the provider's API.** NetBird holds credentials for your IdP and reads users and groups from it on a
+schedule. You can also trigger a sync by hand from the dashboard. Google Workspace and Entra ID (API) work this way.
+
+**Push, over SCIM.** Your IdP sends changes to NetBird as they happen, using a SCIM endpoint and token that NetBird
+issues. There is no manual sync to trigger, because NetBird is the receiver. Entra ID (SCIM), Okta, JumpCloud, and any
+generic SCIM provider work this way.
+
+The practical difference is timing and troubleshooting. A pull integration is late by at most one sync cycle and you can
+force it. A push integration is near-immediate, but when it stalls you fix it in your IdP's provisioning logs, not in
+NetBird.
+
 ## Supported Identity Providers
 
 NetBird provides native support for syncing with the most popular identity providers. Pick yours below for detailed setup and configuration steps.
 
+| Provider | Direction | Set up in NetBird with |
+| --- | --- | --- |
+| Google Workspace | Pull (API) | `Connect Google Workspace` |
+| Entra ID (API) | Pull (API) | `Connect Entra ID (API)` |
+| Entra ID (SCIM) | Push (SCIM) | `Connect Entra ID (SCIM)` |
+| Okta | Push (SCIM) | `Connect Okta` |
+| JumpCloud | Push (SCIM) | `Connect Jumpcloud` |
+| Keycloak | Push (SCIM) | `Connect Generic SCIM` |
+| IIJ ID | Push (SCIM) | `Connect Generic SCIM` |
+
+Keycloak and IIJ ID have no dedicated card on the `Identity Provider Sync` tab. Both are set up through
+`Connect Generic SCIM`, and their guides below walk through that path.
+
+<Note>
+    You can only have one IdP-Sync integration enabled at a time. While one is enabled, the setup buttons on
+    every other card are disabled, so switching providers means disabling the current integration first.
+</Note>
+
 ### Entra ID (API)
 
 Provision users and groups from Microsoft Entra ID through the Graph API. See [Entra ID (API) setup](/manage/team/idp-sync/microsoft-entra-id-sync).

src/pages/manage/team/idp-sync/keycloak-sync.mdx

@@ -1,6 +1,6 @@
 # Provision Users and Groups From Keycloak
 
-Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO),
+Keycloak is an open source identity and access management solution that provides features like single sign-on (SSO),
 multi-factor authentication (MFA), user federation, and centralized identity management to help organizations
 secure and manage access to their applications and resources.
 

src/pages/manage/team/single-sign-on/auth0.mdx

@@ -1,9 +1,14 @@
 import {Note} from "@/components/mdx";
 
-# Auth0 on NetBird Cloud 
+# Auth0 on NetBird Cloud
 
 You can use Auth0 as your Identity Provider with NetBird, but it will require some additional configuration steps. Auth0 is a flexible, drop-in solution to add authentication and authorization services to your applications. It's a managed service that offers extensive customization options, developer-friendly APIs, universal login, social identity providers, and advanced security features like anomaly detection and breached password detection.
 
+<Note>
+    Support for OIDC-compliant IdPs is available on the Team plan and higher.
+    The Free plan supports Google, Microsoft, and social logins.
+</Note>
+
 1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications
 
 2. Click **+ Create Application**
@@ -15,24 +20,24 @@ You can use Auth0 as your Identity Provider with NetBird, but it will require so
 </p>
 
 4. On the New Application screen, go to the Settings tab and under Application URIs set the following values:
-- Application Login URI: https://app.netbird.io
-- Allowed Callback URLs: https://login.netbird.io/login/callback
-- Allowed Logout URLs: https://app.netbird.io
-- Allowed Web Origins: https://app.netbird.io
+- **Application Login URI**: `https://app.netbird.io`
+- **Allowed Callback URLs**: `https://login.netbird.io/login/callback`
+- **Allowed Logout URLs**: `https://app.netbird.io`
+- **Allowed Web Origins**: `https://app.netbird.io`
 
 <p>
     <img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-configure.png" alt="auth0-application-configure" className="imagewrapper-big"/>
 </p>
 
-6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
+5. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
 
-7. Retrieve Application's **Domain** from the **Basic Information** tab
+6. Retrieve Application's **Domain** from the **Basic Information** tab
 
 <p>
     <img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-domain.png" alt="auth0-application-domain" className="imagewrapper-big"/>
 </p>
 
-8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information:
+7. Share the following with our team. Please use a secure method for sharing the sensitive parts of this information:
    1. Application's **Domain**,
    2. (sensitive) **Client ID** and **Client Secret**,
    3. list of email domains to be registered for this SSO configuration,

src/pages/manage/team/single-sign-on/authentik.mdx

@@ -1,8 +1,8 @@
 import {Note} from "@/components/mdx";
 
-# Authentik on NetBird Cloud 
+# Authentik on NetBird Cloud
 
-You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols.
+You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols.
 
 <Note>
     Support for OIDC-compliant IdPs is available on the Team plan and higher.
@@ -38,7 +38,7 @@ You can use Authentik as your Identity Provider with NetBird, but it will requir
     <img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/5-new-application-sign.png" alt="new-application" className="imagewrapper-big"/>
 </p>
 
-    - Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
+    - Click on Advanced protocol settings and ensure that the `openid`, `email`, and `profile` scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
 
 <p>
     <img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/6-new-application-scopes.png" alt="new-application" className="imagewrapper-big"/>