The Community and Professional editions handle day-to-day governance: managing users, syncing permissions, approving access requests. But when an auditor walks in and asks, “prove your access is compliant”, you need more.
- CertificationHas every permission been reviewed?
- ComplianceAre controls passing or failing?
- SCIM 2.0Can identity providers provision users?
- Conflict resolutionWhat wins when app data disagrees?
Why Enterprise?
Enterprise adds four capabilities that answer the hard compliance questions:
- Access Certification Campaigns – “Has every permission been reviewed and approved?”
- Compliance Dashboards – “Are we meeting ISO 27001 / SOX / NIS2 requirements?”
- SCIM 2.0 Provisioning – “Can our Azure AD automatically push users here?”
- Conflict Resolution – “What happens when data disagrees between apps?”
1. Access Certification Campaigns
The problem: Permissions accumulate over time. People change roles, projects end, contractors leave, but their access often stays. Without periodic reviews, you end up with stale permissions nobody has looked at in a year.
What it does: A certification campaign takes every permission in your Access Matrix and asks a reviewer to confirm: “Should this person still have this access?”
| Scope | Reviewer | Status |
|---|---|---|
| High privilege access | Governance owner | Approved |
| External collaborators | Project owner | In review |
| Inactive users | Security team | Revoke pending |
How it works
- Create a campaign. Give it a name, choose the scope, and set a deadline.
- Start the campaign. OpenCrowd generates one review item for every permission in the Access Matrix.
- Review. Reviewers see who has the permission, what permission it is, which application it belongs to, and which resource it affects.
- Auto-revoke. When an item is revoked, OpenCrowd removes it from the Access Matrix without manual follow-up.
What the auditor sees: A completed campaign record showing total permissions reviewed, who reviewed them, what was revoked, and when it was done. That is evidence of periodic access review.
2. Compliance Dashboards
The problem: Your CISO asks “are we ISO 27001 compliant for access control?” and nobody can answer without pulling spreadsheets together.
What it does: OpenCrowd automatically assesses your governance posture against major frameworks and gives you a score with pass, warning, or fail on each control.
ISO 27001 – A.9 Access Control
- A.9.2.1 – Are offboarded users still having active access?
- A.9.2.2 – Do all active users have at least basic access provisioned?
- A.9.2.5 – Has an access review been completed in the last 90 days?
- A.9.2.6 – Were access rights removed when people left?
- A.9.4.1 – Is admin access limited to a small percentage of users?
SOX – IT General Controls
- ITGC-1 – Do you have a documented access control matrix?
- ITGC-2 – Are there users with conflicting privilege combinations?
- ITGC-3 – Have periodic access reviews been completed?
- ITGC-4 – Is all access formally approved before provisioning?
- ITGC-5 – Are all access changes logged and auditable?
NIS2 – Network and Information Systems Directive 2
- Art.21(2)(i) – Human resources security and access control policies.
- Art.21(2)(j) – Multi-factor authentication enforcement.
- Art.23 – Governance alerts and incident notifications configured.
- Art.21(2)(a) – Risk-based approach to access.
Each check shows what was checked, what was found, and what needs fixing. Click a failing check to see the specific users or permissions causing the issue.
3. SCIM 2.0 Provisioning
The problem: Your company uses Azure AD, Okta, or another identity provider. HR creates and disables users there, but OpenCrowd needs to know about those lifecycle changes automatically.
What it does: SCIM, the System for Cross-domain Identity Management, lets identity providers automatically push user lifecycle events to OpenCrowd.
- HR creates a user in Azure AD.
- Azure AD sends
POST /scim/v2/Usersto OpenCrowd. - OpenCrowd creates the user internally.
- On sync, the user is provisioned to connected apps such as xWiki, OpenProject, and Nextcloud.
The same flow works in reverse. When HR disables a user, Azure AD sends an update with active: false, OpenCrowd disables the user, and access can be revoked across connected apps.
| Provider | Configuration |
|---|---|
| Azure AD / Entra ID | Enterprise Application to Provisioning to SCIM endpoint |
| Okta | Applications to Add SCIM Provisioning |
| OneLogin | Provisioning to SCIM connector |
| JumpCloud | Directory to SCIM integration |
| Any SCIM 2.0 client | Configure endpoint URL and bearer token |
4. Conflict Resolution
The problem: Someone changes a user’s email directly in xWiki. Someone else updates the same user’s name in OpenProject. Now OpenCrowd has one version, xWiki has another, and OpenProject has a third.
What it does: During synchronization, OpenCrowd detects when data does not match between its database and connected apps. Instead of silently overwriting, it creates a conflict an admin can review and resolve.
| Conflict | Application | Decision |
|---|---|---|
| Email mismatch | xWiki | Merge |
| Missing local user | OpenProject | Keep remote |
| Permission drift | Nextcloud | Revoke |
| Type | What it means | Example |
|---|---|---|
| Data Mismatch | Same user, different values | Email differs between OpenCrowd and xWiki |
| Missing Local | Exists in app but not in OpenCrowd | User created directly in OpenProject |
| Missing Remote | Exists in OpenCrowd but not in app | User deleted from Nextcloud |
| Duplicate | Multiple matches found | Two similar users matched during sync |
| Permission Drift | Permission changed outside OpenCrowd | Admin granted directly in xWiki |
When Do You Need Enterprise?
| If you need to… | You need… |
|---|---|
| Prove to auditors that access is periodically reviewed | Access Certifications |
| Show ISO 27001 / SOX / NIS2 compliance status | Compliance Dashboards |
| Auto-provision users from Azure AD / Okta | SCIM 2.0 |
| Handle sync conflicts without data loss | Conflict Resolution |
Try It
Enterprise features activate with one environment variable:
OPENCROWD_EDITION=enterpriseContact us for an Enterprise trial at info@opencrowd.io, or deploy the Community Edition for free:
git clone https://github.com/opencrowd-io/opencrowd.git
cd opencrowd/infrastructure/docker && docker compose up -d