diff --git a/src/langsmith/administration-overview.mdx b/src/langsmith/administration-overview.mdx
index 6abdb619..271cdf68 100644
--- a/src/langsmith/administration-overview.mdx
+++ b/src/langsmith/administration-overview.mdx
@@ -9,7 +9,7 @@ This overview covers topics related to managing users, organizations, and worksp
### Organizations
-An organization is a logical grouping of users within LangSmith with its own billing configuration. Typically, there is one organization per company. An organization can have multiple workspaces. For more details, see the [setup guide](/langsmith/set-up-organization).
+An organization is a logical grouping of users within LangSmith with its own billing configuration. Typically, there is one organization per company. An organization can have multiple workspaces. For more details, see the [setup guide](/langsmith/set-up-a-workspace#set-up-an-organization).
When you log in for the first time, a personal organization will be created for you automatically. If you'd like to collaborate with others, you can create a separate organization and invite your team members to join. There are a few important differences between your personal organization and shared organizations:
@@ -25,7 +25,7 @@ When you log in for the first time, a personal organization will be created for
Workspaces were formerly called Tenants. Some code and APIs may still reference the old name for a period of time during the transition.
-A workspace is a logical grouping of users and resources within an organization. A workspace separates trust boundaries for resources and access control. Users may have permissions in a workspace that grant them access to the resources in that workspace, including tracing projects, datasets, annotation queues, and prompts. For more details, see the [setup guide](/langsmith/set-up-workspace).
+A workspace is a logical grouping of users and resources within an organization. A workspace separates trust boundaries for resources and access control. Users may have permissions in a workspace that grant them access to the resources in that workspace, including tracing projects, datasets, annotation queues, and prompts. For more details, see the [setup guide](/langsmith/set-up-a-workspace).
It is recommended to create a separate workspace for each team within your organization. To organize resources even further, you can use [Resource Tags](#resource-tags) to group resources within a workspace.
@@ -110,7 +110,7 @@ Service keys are prefixed with `lsv2_sk_`
### Organization roles
-Organization roles are distinct from the Enterprise feature (RBAC) below and are used in the context of multiple [workspaces](#workspaces). Your organization role determines your workspace membership characteristics and your organization-level permissions. See the [organization setup guide](/langsmith/set-up-organization#organization-roles) for more information.
+Organization roles are distinct from the Enterprise feature (RBAC) below and are used in the context of multiple [workspaces](#workspaces). Your organization role determines your workspace membership characteristics and your organization-level permissions. See the [organization setup guide](/langsmith/set-up-a-workspace#organization-roles) for more information.
The organization role selected also impacts workspace membership as described here:
@@ -158,7 +158,7 @@ Roles can be managed in organization settings under the `Roles` tab:
-For more details on assigning and creating roles, see the [access control setup guide](/langsmith/set-up-access-control).
+For more details on assigning and creating roles, see the [access control setup guide](/langsmith/user-management).
## Best Practices
@@ -175,7 +175,7 @@ In May 2024, LangSmith introduced a maximum data retention period on traces of 4
#### Why retention matters
* **Privacy**: Many data privacy regulations, such as GDPR in Europe or CCPA in California, require organizations to delete personal data once it's no longer necessary for the purposes for which it was collected. Setting retention periods aids in compliance with such regulations.
-* **Cost**: LangSmith charges less for traces that have low data retention. See our tutorial on how to [optimize spend](/langsmith/manage-spend) for details.
+* **Cost**: LangSmith charges less for traces that have low data retention. See our tutorial on how to [optimize spend](/langsmith/billing#optimize-your-tracing-spend) for details.
#### How it works
@@ -358,4 +358,4 @@ Usage limits can be updated from the `Settings` page under `Usage and Billing`.
### Related content
-* Tutorial on how to [optimize spend](/langsmith/manage-spend)
+* Tutorial on how to [optimize spend](/langsmith/billing#optimize-your-tracing-spend)
diff --git a/src/langsmith/authentication-methods.mdx b/src/langsmith/authentication-methods.mdx
index 4a5ca424..0708d81a 100644
--- a/src/langsmith/authentication-methods.mdx
+++ b/src/langsmith/authentication-methods.mdx
@@ -17,7 +17,7 @@ Users can alternatively use their credentials from GitHub or Google.
### SAML SSO
-Enterprise customers can configure [SAML SSO](/langsmith/set-up-saml-sso) and [SCIM](/langsmith/set-up-scim)
+Enterprise customers can configure [SAML SSO](/langsmith/user-management) and [SCIM](/langsmith/user-management)
## Self-Hosted
diff --git a/src/langsmith/billing.mdx b/src/langsmith/billing.mdx
new file mode 100644
index 00000000..31223b04
--- /dev/null
+++ b/src/langsmith/billing.mdx
@@ -0,0 +1,293 @@
+---
+title: Manage billing in your account
+sidebarTitle: Manage billing
+---
+
+This page describes how to manage billing for your LangSmith organization:
+
+- [Set up billing for your account](#set-up-billing-for-your-account): Complete the billing setup process for Developer and Plus plans, including special instructions for legacy accounts.
+- [Update your information](#update-your-information): Modify invoice email addresses, business information, and tax IDs for your organization.
+- [Optimize your tracing spend](#optimize-your-tracing-spend): Learn how to reduce costs through data retention management and usage limits.
+
+## Set up billing for your account
+
+
+Before using this guide, note the following:
+
+- If you are interested in the [Enterprise](https://www.langchain.com/pricing) plan, please [contact sales](https://www.langchain.com/contact-sales). This guide is only for our self-serve billing plans.
+- If you created your LangSmith organization before pricing was introduced on April 2nd, 2024, please [skip to the final section](#set-up-billing-for-accounts-created-before-pricing-was-introduced-on-april-2-2024).
+
+
+To set up billing for your LangSmith organization, navigate to the [Usage and Billing](https://smith.langchain.com/settings/payments) page under **Settings**. Depending on your organization's settings, there are different setup guides:
+
+- [Developer plan](#developer-plan%3A-set-up-billing-on-your-personal-organization)
+- [Plus plan](#plus-plan%3A-set-up-billing-on-a-shared-organization)
+- [Setup for accounts created before April 2, 2024 pricing introduction](#set-up-billing-for-accounts-created-before-pricing-introduction)
+
+### Developer Plan: set up billing on your personal organization
+
+Personal organizations are limited to 5000 traces per month until a credit card is added. You can add a credit card on the **Plans and Billing** page as follows:
+
+1. Click **Set up Billing**
+
+ 
+
+2. Add your credit card information. After this step, you will no longer be rate limited to 5000 traces, and you will be charged for any excess traces at rates specified on the [pricing](https://www.langchain.com/pricing-langsmith) page.
+
+### Plus Plan: set up billing on a shared organization
+
+If you have not yet created an organization, you need to follow [this guide](/langsmith/set-up-a-workspace#set-up-an-organization) before setting up billing. The following steps assume you are already in a new organization.
+
+
+You can't use a new organization until you enter credit card information. After you complete the following steps, you will gain complete access to LangSmith.
+
+
+1. Click **Subscribe** on the **Plus** page.
+
+
+ If you are a startup building with AI, instead click **Apply Now** on the Startup Plan. You may be eligible for discounted prices and a free, monthly trace allotment.
+
+
+ 
+
+2. Review your existing members. Before subscribing, LangSmith lets you remove any added users that you do **not** want to be included in the bill.
+
+ 
+
+3. Enter your credit card information. Then, enter business information, invoice email, and tax ID. If this organization belongs to a business, check the **This is a business** checkbox and enter the information accordingly.
+
+For more information, refer to the [Update your information section](#update-your-information).
+
+Once this step is complete, your organization will have access to the rest of LangSmith.
+
+### Set up billing for accounts created before pricing introduction
+
+If you joined LangSmith before pricing was introduced on April 2, 2024, you have the option to upgrade your existing account to set up billing. If you did not set up billing by July 8, 2024, then your account is now rate limited to a maximum of 5,000 traces per month.
+
+1. Navigate to the [Settings](https://smith.langchain.com/settings) page.
+2. Click **Set up Billing**.
+
+ 
+
+3. Enter your credit card information. If you are on a Personal organization, this will add you to the Developer plan. If you are on a shared organization, this will add you to the Plus plan. For more information, refer to the guides for the [Developer](#developer-plan%3A-set-up-billing-on-your-personal-organization) or [Plus](#plus-plan%3A-set-up-billing-on-a-shared-organization) plans respectively, starting at step 2.
+4. Claim free credits as a thank you for being an early LangSmith user.
+
+## Update your information
+
+To update business information for your LangSmith organization, head to the [Usage and Billing](https://smith.langchain.com/settings/payments) page under **Settings** and click on the [Plans and Billing](https://smith.langchain.com/settings/payments?tab=2) tab.
+
+
+Business information, tax ID, and invoice email can only be updated for the Plus and Startup plans. Free and Developer plans cannot update this information.
+
+
+### Invoice email
+
+
+
+To update the email address for invoices, follow these steps:
+
+1. Navigate to the **Plans and Billing** tab.
+2. Locate the section beneath the payment method, where the current invoice email is displayed.
+3. Enter the new email address for invoices in the provided field.
+4. The new email address will be automatically saved.
+
+You will receive all future invoices to the updated email address.
+
+### Business information and tax ID
+
+
+In certain jurisdictions, LangSmith is required to collect sales tax. If you are a business, providing your tax ID may qualify you for a sales tax exemption.
+
+
+
+
+To update your organization's business information, follow these steps:
+
+1. Navigate to the **Plans and Billing** tab.
+2. Below the invoice email section, you will find a checkbox labeled **Business**.
+3. Check the **Business** checkbox if your organization belongs to a business.
+4. A business information section will appear, allowing you to enter or update the following details:
+ - Business Name
+ - Address
+ - Tax ID for applicable jurisdictions
+5. A Tax ID field will appear for applicable jurisdictions after you select a country.
+6. After entering the necessary information, click the **Save** button to save your changes.
+
+This ensures that your business information is up-to-date and accurate for billing and tax purposes.
+
+## Optimize your tracing spend
+
+
+You may find it helpful to read the following pages, before continuing with this section on optimizing your tracing spend:
+
+- [Data Retention Conceptual Docs](/langsmith/administration-overview#data-retention)
+- [Usage Limiting Conceptual Docs](/langsmith/administration-overview#usage-limits)
+
+
+
+Some of the features mentioned in this guide are not currently available on Enterprise plan due to its custom nature of billing. If you are on the Enterprise plan and have questions about cost optimization, reach out to your sales rep or [support@langchain.dev](mailto:support@langchain.dev).
+
+
+You will learn how to optimize existing spend and prevent future overspend in LangSmith, which includes:
+
+1. Reducing existing costs with data retention policies.
+2. Preventing future overspend with usage limits.
+
+This tutorial will use an existing LangSmith organization with high usage. You can transfer the concepts from this example to your own organization. The example organization has three [workspaces](/langsmith/administration-overview#workspaces), one for each deployment stage (`Dev`, `Staging`, and `Prod`):
+
+
+
+### Understand your current usage
+
+The first step of any optimization process is to understand current usage. LangSmith provides two ways to do this: [Usage graph](#usage-graph) and [Invoices](#invoices).
+
+#### Usage graph
+
+The usage graph lets you examine how much of each usage-based pricing metric you have consumed. It does not directly show spend (which you will review later in the draft invoice).
+
+You can navigate to the usage graph under **Settings** -> **Usage and Billing** -> **Usage Graph**.
+
+
+
+This graph shows that there are two usage metrics that LangSmith charges for:
+
+- LangSmith Traces (Base Charge): tracks all traces that you send to LangSmith.
+- LangSmith Traces (Extended Data Retention Upgrades): tracks all traces that also have our Extended 400 Day Data Retention.
+
+For more details, refer to the [data retention conceptual docs](/langsmith/administration-overview#data-retention). Notice that these graphs look identical, which you will review later in the tutorial.
+
+LangSmith Traces usage is measured per workspace, because workspaces often represent development environments (as in the example), or teams within an organization. As a LangSmith administrator, you may want to understand spend granularly per each of these units. In this case where you just want to cut spend, you can focus on the environment responsible for the majority of costs first for the greatest savings.
+
+#### Invoices
+
+You understand what usage looks like in terms of traces, but you now need to translate that into spend. To do so, navigate to the **Invoices** tab. The first invoice that will appear on screen is a draft of your current month's invoice, which shows your running spend thus far this month.
+
+
+
+
+LangSmith's Usage Graph and Invoice use the term `tenant_id` to refer to a workspace ID. They are interchangeable.
+
+
+In the GIF, you'll see that the charges for LangSmith Traces are broken up by "tenant\_id" (i.e., workspace ID), which means you can track tracing spend on each of the workspaces. In the first few days of June, the vast majority of the total spend of roughly $2,000 is in the production workspace. Further, the majority of spend in that workspace was on extended data retention trace upgrades.
+
+These upgrades occur for two reasons:
+
+1. You use extended data retention tracing, which means by default your traces are retained for 400 days.
+2. You use base data retention tracing and use a feature that automatically extends the data retention of a trace. ([Refer to the Auto-Upgrade conceptual docs](/langsmith/administration-overview#data-retention).)
+
+Given that the number of total traces per day is equal to the number of extended retention traces per day, it's most likely the case that this organization is using extended data retention tracing everywhere. As a result, start by optimizing the retention settings.
+
+### Optimization 1: manage data retention
+
+LangSmith charges differently based on a trace's [data retention](/langsmith/administration-overview#data-retention), where short-lived traces are an order of magnitude less expensive than ones that last for a long time. In this optimization, you'll learn how to get optimal settings for data retention without sacrificing historical observability, and see the effect it has on the bill.
+
+#### Change org level retention defaults for new projects
+
+Navigate to the **Usage configuration** tab, and look at the organization level retention settings. Modifying this setting affects all **new projects** that are created going forward in all workspaces in the organizaton.
+
+
+For backwards compatibility, older organizations may have this defaulted to **Extended**. Organizations created after June 3rd, 2024 have this defaulted to **Base**.
+
+
+
+
+#### Change project level retention defaults
+
+Data retention settings are adjustable per project on the tracing project page.
+
+Navigate to **Projects** > ***Your project name*** > Select **Retention** and modify the default retention of the project to **Base**. This will only affect retention (and pricing) for **traces going forward**.
+
+
+
+#### Apply extended data retention to a percentage of traces
+
+You may not want all traces to expire after 14 days. You can automatically extend the retention of traces that match some criteria by creating an [automation rule](/langsmith/rules). You might want to apply extended data retention to specific types of traces, such as:
+
+* 10% of all traces: For general analysis or analyzing trends long term.
+* Errored traces: To investigate and debug issues thoroughly.
+* Traces with specific metadata: For long-term examination of particular features or user flows.
+
+To configure this:
+
+1. Navigate to **Projects** > ***Your project name*** > Select **+ New** > Select **New Automation**.
+2. Name your rule and optionally apply filters or a sample rate. For more information on configuring filters, refer to [filtering techniques](/langsmith/filter-traces-in-application#filter-operators).
+
+
+When an automation rule matches any [run](/langsmith/observability-overview#runs) within a [trace](/langsmith/observability-overview#traces), then all runs within the trace are upgraded to be retained for 400 days.
+
+
+For example, this is the expected configuration to keep 10% of all traces for extended data retention:
+
+
+
+If you want to keep a subset of traces for **longer than 400 days** for data collection purposes, you can create another run rule that sends some runs to a dataset of your choosing. A dataset allows you to store the trace inputs and outputs (e.g., as a key-value dataset), and will persist indefinitely, even after the trace gets deleted.
+
+#### See results after 7 days
+
+While the total amount of traces per day stayed the same, the extended data retention traces was cut heavily. In the invoice, the spend reduced to roughly \$900 in the last 7 days, as opposed to $2,000 in the previous 4. That's a cost reduction of nearly 75% per day.
+
+
+
+### Optimization 2: limit usage
+
+In the previous section, you managed data retention settings to **optimize existing spend**. In this section, you will use usage limits to **prevent future overspend**.
+
+LangSmith has two usage limits: total traces and extended retention traces. These correspond to the two metrics tracked on the [usage graph](#usage-graph). You can use these in tandem to have granular control over spend.
+
+To set limits, navigate back to **Settings** -> **Usage and Billing** -> **Usage configuration**. There is a table at the bottom of the page that lets you set usage limits per workspace. For each workspace, the two limits appear, along with a cost estimate:
+
+
+
+Start by setting limits on production usage, since that is where the majority of spend comes from.
+
+#### Set a good total traces limit
+
+Picking the right total traces limit depends on the expected load of traces that you will send to LangSmith. It is important to consider potential growth before setting a limit. For example:
+
+- **Current Load**: The gen AI application is called between 1.2-1.5 times per second, and each API request has a trace associated with it, meaning it logs around 100,000-130,000 traces per day.
+- **Expected Growth in Load**: The expectation is that this will double in size in the near future.
+
+From these assumptions, you can calculate an approximate limit:
+
+```python
+limit = current_load_per_day * expected_growth * days/month
+ = 130,000 * 2 * 30
+ = 7,800,000 traces / month
+```
+
+Click on the edit icon on the right side of the table for the **Prod** row to enter the limit.
+
+
+
+
+When set without the extended data retention traces limit, the maximum cost estimator assumes that all traces are using extended data retention.
+
+
+#### Cut maximum spend with an extended data retention limit
+
+From [Optimization 1](#optimization-1-manage-data-retention), you learned that the easiest way to cut cost was through managing data retention. The same is true for limits. If you only want to keep roughly 10% of traces to be around more than 14 days, you can set a limit on the maximum high retention traces you can keep. This would result in `.10 * 7,800,000 = 780,000`.
+
+
+
+The maximum cost is cut from \~40k per month to \~7.5k per month, because you no longer allow as many expensive data retention upgrades. This ensures that new users on the platform will not accidentally cause cost to balloon.
+
+
+The extended data retention limit can cause features other than traces to stop working once reached. If you plan to use this feature, read more about its [functionality and side effects](/langsmith/administration-overview#side-effects-of-extended-data-retention-traces-limit).
+
+
+#### Set dev/staging limits and view total spent limit across workspaces
+
+Following a similar logic for the `dev` and `staging` environments, you can set limits at 10% of the production limit on usage for each workspace.
+
+While this works with this usage pattern, setting good dev and staging limits may vary depending on your use case with LangSmith. For example, if you run evals as part of CI/CD in dev or staging, you may want to be more flexible with your usage limits to avoid test failures.
+
+With the limits set, LangSmith shows a maximum spend estimate across all workspaces:
+
+
+
+You can use the cost estimate to plan for your invoice total.
+
+### Summary
+
+If you have questions about further optimizing your spend, please reach out to [support@langchain.dev](mailto:support@langchain.dev).
+
diff --git a/src/langsmith/evaluate-pairwise.mdx b/src/langsmith/evaluate-pairwise.mdx
index cc56dd1d..ee092fbd 100644
--- a/src/langsmith/evaluate-pairwise.mdx
+++ b/src/langsmith/evaluate-pairwise.mdx
@@ -78,7 +78,7 @@ Note that you should choose a feedback key that is distinct from standard feedba
The following example uses [a prompt](https://smith.langchain.com/hub/langchain-ai/pairwise-evaluation-2) which asks the LLM to decide which is better between two AI assistant responses. It uses structured output to parse the AI's response: 0, 1, or 2.
- In the Python example below, we are pulling [this structured prompt](https://smith.langchain.com/hub/langchain-ai/pairwise-evaluation-2) from the [LangChain Hub](/langsmith/manage-prompts) and using it with a LangChain chat model wrapper.
+ In the Python example below, we are pulling [this structured prompt](https://smith.langchain.com/hub/langchain-ai/pairwise-evaluation-2) from the [LangChain Hub](/langsmith/manage-prompts#public-prompt-hub) and using it with a LangChain chat model wrapper.
**Usage of LangChain is totally optional.** To illustrate this point, the TypeScript example uses the OpenAI SDK directly.
diff --git a/src/langsmith/faq.mdx b/src/langsmith/faq.mdx
index 62acf5c4..fc7dbc83 100644
--- a/src/langsmith/faq.mdx
+++ b/src/langsmith/faq.mdx
@@ -3,26 +3,26 @@ title: Frequently asked questions
sidebarTitle: FAQs
---
-### *I can't create API keys or manage users in the UI, what's wrong?*
+## *I can't create API keys or manage users in the UI, what's wrong?*
* You have likely deployed LangSmith without setting up SSO. LangSmith requires SSO to manage users and API keys. You can find more information on setting up SSO in the [configuration section.](/langsmith/self-host-sso)
-### *How does load balancing/ingress work*?
+## *How does load balancing/ingress work*?
* You will need to expose the frontend container/service to your applications/users. This will handle routing to all downstream services.
* You will need to terminate SSL at the ingress level. We recommend using a managed service like AWS ALB, GCP Load Balancer, or Nginx.
-### *How can we authenticate to the application?*
+## *How can we authenticate to the application?*
* Currently, our self-hosted solution supports SSO with OAuth2.0 and OIDC as an authn solution. Note, we do offer a no-auth solution but highly recommend setting up oauth before moving into production.
You can find more information on setting up SSO in the [configuration section.](/langsmith/self-host-sso)
-### *Can I use external storage services?*
+## *Can I use external storage services?*
* You can configure LangSmith to use external versions of all storage services. In a production setting, we strongly recommend using external storage services. Check out the [configuration section](/langsmith/architectural-overview) for more information.
-### *Does my application need egress to function properly?*
+## *Does my application need egress to function properly?*
Our deployment only needs egress for a few things (most of which can reside within your VPC):
@@ -41,9 +41,46 @@ Our deployment only needs egress for a few things (most of which can reside with
Your VPC can set up rules to limit any other access. Note: We require the `X-Organization-Id` and `X-Tenant-Id` headers to be allowed to be passed through to the backend service. These are used to determine which organization and workspace (previously called "tenant") the request is for.
-### *Resource requirements for the application?*
+## *Resource requirements for the application?*
* In kubernetes, we recommend a minimum helm configuration which can be found in [here](https://github.com/langchain-ai/helm/blob/main/charts/langsmith/examples/medium_size.yaml). For docker, we recommend a minimum of 16GB of RAM and 4 CPUs.
* For Postgres, we recommend a minimum of 8GB of RAM and 2 CPUs.
* For Redis, we recommend 4GB of RAM and 2 CPUs.
* For Clickhouse, we recommend 32GB of RAM and 8 CPUs.
+
+## SAML SSO FAQs
+
+### *How do I change a SAML SSO user's email address?*
+
+Some identity providers retain the original `User ID` through an email change while others do not, so we recommend that you follow these steps to avoid duplicate users in LangSmith:
+
+1. Remove the user from the organization (see [here](/langsmith/set-up-a-workspace#manage-users))
+2. Change their email address in the IdP
+3. Have them login to LangSmith again via SAML SSO - this will trigger the usual [JIT provisioning](#just-in-time-jit-provisioning) flow with their new email address
+
+### *How do I fix "405 method not allowed"?*
+
+Ensure you're using the correct ACS URL: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs)
+
+## SCIM FAQs
+
+### *Can I use SCIM without SAML SSO?*
+
+* **Cloud**: No, SAML SSO is required for SCIM in cloud deployments
+* **Self-hosted**: Yes, SCIM works with OAuth with Client Secret authentication mode
+
+### *What happens if I have both JIT provisioning and SCIM enabled?*
+
+JIT provisioning and SCIM can conflict with each other. We recommend disabling JIT provisioning before enabling SCIM to ensure consistent user provisioning behavior.
+
+### *How do I change a user's role or workspace access?*
+
+Update the user's group membership in your IdP. The changes will be synchronized to LangSmith according to the [role precedence rules](#role-precedence).
+
+### *What happens when a user is removed from all groups?*
+
+The user will be deprovisioned from your LangSmith organization according to your IdP's deprovisioning settings.
+
+### *Can I use custom group names?*
+
+No, groups must follow the specific naming convention described in the [Group Naming Convention](#group-naming-convention) section to properly map to LangSmith roles and workspaces.
diff --git a/src/langsmith/manage-datasets.mdx b/src/langsmith/manage-datasets.mdx
index 145c265a..c3cdecd3 100644
--- a/src/langsmith/manage-datasets.mdx
+++ b/src/langsmith/manage-datasets.mdx
@@ -24,7 +24,7 @@ By default, the version is defined by the timestamp of the change. When you clic
-Note that examples are read-only when viewing a past version of the dataset. You will also see the operations that were between this version of the dataset and the "latest" version of the dataset.
+Note that examples are read-only when viewing a past version of the dataset. You will also see the operations that were between this version of the dataset and the latest version of the dataset.
By default, the latest version of the dataset is shown in the **Examples** tab and experiments from all versions are shown in the **Tests** tab.
@@ -223,9 +223,11 @@ From the **Dataset & Experiments** tab, select a dataset, click **⋮** (top rig
### Unshare a dataset
-1. Click on **Unshare** by click on **Public** in the upper right hand corner of any publicly shared dataset, then **Unshare** in the dialog. 
+1. Click on **Unshare** by clicking on **Public** in the upper right hand corner of any publicly shared dataset, then **Unshare** in the dialog. 
-2. Navigate to your organization's list of publicly shared datasets, by clicking on **Settings** -> **Shared URLs** or [this link](https://smith.langchain.com/settings/shared), then click on **Unshare** next to the dataset you want to unshare. 
+2. Navigate to your organization's list of publicly shared datasets, by clicking on **Settings** -> **Shared URLs** or [this link](https://smith.langchain.com/settings/shared), then click on **Unshare** next to the dataset you want to unshare.
+
+
## Export a dataset
diff --git a/src/langsmith/manage-organization-by-api.mdx b/src/langsmith/manage-organization-by-api.mdx
index e88ade25..76bbb38f 100644
--- a/src/langsmith/manage-organization-by-api.mdx
+++ b/src/langsmith/manage-organization-by-api.mdx
@@ -9,7 +9,7 @@ LangSmith's API supports programmatic access via API key to all of the actions a
Before diving into this content, it might be helpful to read the following:
* [Conceptual guide on organizations and workspaces](/langsmith/administration-overview)
-* [Organization setup how-to guild](/langsmith/set-up-organization)
+* [Organization setup how-to guild](/langsmith/set-up-a-workspace#set-up-an-organization)
@@ -81,7 +81,7 @@ Workspace level:
These endpoints are user-scoped and require a logged-in user's JWT, so they should only be executed through the UI.
* `/api-key/current` endpoints: these are related a user's PATs
-* `/sso/email-verification/send` (Cloud-only): this endpoint is related to [SAML SSO](/langsmith/set-up-saml-sso)
+* `/sso/email-verification/send` (Cloud-only): this endpoint is related to [SAML SSO](/langsmith/user-management)
## Sample Code
diff --git a/src/langsmith/manage-prompts-programmatically.mdx b/src/langsmith/manage-prompts-programmatically.mdx
index 7c2416c1..7b5d6797 100644
--- a/src/langsmith/manage-prompts-programmatically.mdx
+++ b/src/langsmith/manage-prompts-programmatically.mdx
@@ -214,7 +214,7 @@ Similar to pushing a prompt, you can also pull a prompt as a RunnableSequence of
-When pulling a prompt, you can also specify a specific commit hash or [commit tag](/langsmith/manage-prompts) to pull a specific version of the prompt.
+When pulling a prompt, you can also specify a specific commit hash or [commit tag](/langsmith/manage-prompts#commit-tags) to pull a specific version of the prompt.
diff --git a/src/langsmith/manage-spend.mdx b/src/langsmith/manage-spend.mdx
deleted file mode 100644
index 5ca1d831..00000000
--- a/src/langsmith/manage-spend.mdx
+++ /dev/null
@@ -1,188 +0,0 @@
----
-title: Optimize tracing spend on LangSmith
-sidebarTitle: Optimize tracing spend
----
-
-
- Before diving into this content, it might be helpful to read the following:
-
- * [Data Retention Conceptual Docs](/langsmith/administration-overview#data-retention)
-* [Usage Limiting Conceptual Docs](/langsmith/administration-overview#usage-limits)
-
-
-
- Some of the features mentioned in this guide are not currently available in Enterprise plan due to its custom nature of billing. If you are on Enterprise plan and have questions about cost optimization, please reach out to your sales rep or [support@langchain.dev](mailto:support@langchain.dev).
-
-
-This tutorial walks through optimizing your spend on LangSmith. In it, we will learn how to optimize existing spend and prevent future overspend on a realistic real-world example. We will use an existing LangSmith organization with high usage. Concepts can be transferred to your own organization.
-
-## Problem Setup
-
-In this tutorial, we take an existing organization that has three workspaces, one for each deployment stage (Dev, Staging, and Prod):
-
-
-
-## Understand your current usage
-
-The first step of any optimization process is to understand current usage. LangSmith gives two ways to do this: Usage Graph and Invoices.
-
-### Usage Graph
-
-The usage graph lets us examine how much of each usage based pricing metric we have consumed lately. It does not directly show spend (which we will see later on our draft invoice).
-
-We can navigate to the Usage Graph under `Settings` -> `Usage and Billing` -> `Usage Graph`.
-
-
-
-We see in the graph above that there are two usage metrics that LangSmith charges for:
-
-* LangSmith Traces (Base Charge)
-* LangSmith Traces (Extended Data Retention Upgrades).
-
-The first metric tracks all traces that you send to LangSmith. The second tracks all traces that also have our Extended 400 Day Data Retention. For more details, see our [data retention conceptual docs](/langsmith/administration-overview#data-retention). Notice that these graphs look identical, which will come into play later in the tutorial.
-
-LangSmith Traces usage is measured per workspace, because workspaces often represent development environments (as in our example), or teams within an organization. As a LangSmith administrator, we want to understand spend granularly per each of these units. In this case where we just want to cut spend, we can focus on the environment responsible for the majority of costs first for the greatest savings.
-
-### Invoices
-
-We understand what usage looks like in terms of traces, but we now need to translate that into spend. To do so, we head to the `Invoices` tab. The first invoice that will appear on screen is a draft of your current month's invoice, which shows your running spend thus far this month.
-
-
-
-
- LangSmith's Usage Graph and Invoice use the term `tenant_id` to refer to a workspace ID. They are interchangeable.
-
-
-In the above GIF, we see that the charges for LangSmith Traces are broken up by "tenant\_id" (i.e. Workspace ID), meaning we can track tracing spend on each of our workspaces. In the first few days of June, the vast majority of the total spend of \~$2,000 is in our production workspace. Further, the majority of spend in that workspace was on extended data retention trace upgrades.
-
-These upgrades occur for two reasons:
-
-1. You use extended data retention tracing, meaning that, by default, your traces are retained for 400 days
-2. You use base data retention tracing, and use a feature that automatically extends the data retention of a trace ([see our Auto-Upgrade conceptual docs](/langsmith/administration-overview#data-retention))
-
-Given that the number of total traces per day is equal to the number of extended retention traces per day, it's most likely the case that this org is using extended data retention tracing everywhere. As such, we start by optimizing our retention settings.
-
-## Optimization 1: manage data retention
-
-LangSmith charges differently based on a trace's data retention (see our [data retention conceptual docs](/langsmith/administration-overview#data-retention)), where short-lived traces are an order of magnitude less expensive than ones that last for a long time. In this optimization, we will show how to get optimal settings for data retention without sacrificing historical observability, and show the effect it has on our bill.
-
-### Change org level retention defaults for new projects
-
-Navigate to the **Usage configuration** tab, and look at our organization level retention settings. Modifying this setting affects all **new projects** that are created going forward in all workspaces in our org.
-
-
- For backwards compatibility, older organizations may have this defaulted to **Extended**. Organizations created after June 3rd, 2024 have this defaulted to **Base**.
-
-
-
-
-### Change project level retention defaults
-
-Data retention settings are adjustable per project on the tracing project page.
-
-Navigate to **Projects** > ***Your project name*** > Select **Retention** and modify the default retention of the project to **Base**. This will only affect retention (and pricing) for **traces going forward**.
-
-
-
-### Apply extended data retention to a percentage of traces
-
-You may not want all traces to expire after 14 days. You can automatically extend the retention of traces that match some criteria by creating an [automation rule](/langsmith/rules). You might want to apply extended data retention to specific types of traces, such as:
-
-* 10% of all traces: For general analysis or analyzing trends long-term
-* Errored traces: To thoroughly investigate and debug issues
-* Traces with specific metadata: For long-term examination of particular features or user flows
-
-To configure this:
-
-1. Navigate to **Projects** > ***Your project name*** > Select **+ New** > Select **New Automation**
-2. Name your rule and optionally apply filters or a sample rate. For more information on configuring filters, see [filtering techniques](/langsmith/filter-traces-in-application#filter-operators)
-
-
- When an automation rule matches any [run](/langsmith/observability-overview#runs) within a [trace](/langsmith/observability-overview#traces), then all runs within the trace are upgraded to be retained for 400 days.
-
-
-For example, this is what the configuration looks like to keep 10% of all traces for extended data retention:
-
-
-
-If you want to keep a subset of traces for **longer than 400 days** for data collection purposes, you can create another run rule that sends some runs to a dataset of your choosing. A dataset allows you to store the trace inputs and outputs (e.g., as a key-value dataset), and will persist indefinitely, even after the trace gets deleted.
-
-### See results after 7 days
-
-While the total amount of traces per day stayed the same, the extended data retention traces was cut heavily. In the invoice, we can see that we've only spent about \$900 in the last 7 days, as opposed to \$2,000 in the previous 4.
-
-That's a cost reduction of nearly 75% per day!
-
-
-
-## Optimization 2: limit usage
-
-In the previous section, we managed data retention settings to *optimize existing spend*. In this section, we will use usage limits to *prevent future overspend*.
-
-LangSmith has two usage limits: total traces and extended retention traces. These correspond to the two metrics we've been tracking on our usage graph. We can use these in tandem to have granular control over spend.
-
-To set limits, we navigate back to `Settings` -> `Usage and Billing` -> `Usage configuration`. There is a table at the bottom of the page that lets you set usage limits per workspace. For each workspace, the two limits appear, along with a cost estimate:
-
-
-
-Lets start by setting limits on our production usage, since that is where the majority of spend comes from.
-
-### Setting a good total traces limit
-
-Picking the right "total traces" limit depends on the expected load of traces that you will send to LangSmith. You should clearly think about your assumptions before setting a limit.
-
-For example:
-
-* **Current Load**: Our gen AI application is called between 1.2-1.5 times per second, and each API request has a trace associated with it, meaning we log around 100,000-130,000 traces per day
-* **Expected Growth in Load**: We expect to double in size in the near future.
-
-From these assumptions, we can do a quick back-of-the-envelope calculation to get a good limit of:
-
-```python
-limit = current_load_per_day * expected_growth * days/month
- = 130,000 * 2 * 30
- = 7,800,000 traces / month
-```
-
-We click on the edit icon on the right side of the table for our Prod row, and can enter this limit as follows:
-
-
-
-
- When set without the extended data retention traces limit, the maximum cost estimator assumes that all traces are using extended data retention.
-
-
-### Cutting maximum spend with an extended data retention limit
-
-If we are not a big enterprise, we may shudder at the \~$40k per month bill.
-
-We saw from [Optimization 1](#optimization-1-manage-data-retention) that the easiest way to cut cost was through managing data retention. The same can be said for limits. If we only want to keep \~10% of traces to be around more than 14 days, we can set a limit on the maximum high retention traces we can keep. That would be `.10 * 7,800,000 = 780,000`.
-
-
-
-As we can see, the maximum cost is cut from \~40k per month to \~7.5k per month, because we no longer allow as many expensive data retention upgrades. This lets us be confident that new users on the platform will not accidentally cause cost to balloon.
-
-
- The extended data retention limit can cause features other than traces to stop working once reached. If you plan to use this feature, please read more about its functionality [here](/langsmith/administration-overview#side-effects-of-extended-data-retention-traces-limit).
-
-
-### Set dev/staging limits and view total spent limit across workspaces
-
-Following the same logic for our dev and staging environments, we set limits at 10% of the production limit on usage for each workspace.
-
-While this works with our usage pattern, setting good dev and staging limits may vary depending on your use case with LangSmith. For example, if you run evals as part of CI/CD in dev or staging, you may want to be more liberal with your usage limits to avoid test failures.
-
-Now that our limits are set, we can see that LangSmith shows a maximum spend estimate across all workspaces:
-
-
-
-With this estimator, we can be confident that we will not end up with an unexpected credit card bill at the end of the month.
-
-## Summary
-
-In this tutorial, we learned how to:
-
-1. Cut down our existing costs with data retention policies
-2. Prevent future overspend with usage limits
-
-If you have questions about further optimizing your spend, please reach out to [support@langchain.dev](mailto:support@langchain.dev).
diff --git a/src/langsmith/script-delete-a-workspace.mdx b/src/langsmith/script-delete-a-workspace.mdx
index 88d25159..e78b4611 100644
--- a/src/langsmith/script-delete-a-workspace.mdx
+++ b/src/langsmith/script-delete-a-workspace.mdx
@@ -4,7 +4,7 @@ sidebarTitle: Delete workspaces
---
- Deleting a workspace is supported **nativley in LangSmith Self-Hosted v0.10**. View [instructions for deleting a workspace](/langsmith/set-up-workspace#delete-a-workspace).
+ Deleting a workspace is supported **nativley in LangSmith Self-Hosted v0.10**. View [instructions for deleting a workspace](/langsmith/set-up-a-workspace#delete-a-workspace).
Follow the guide below for Self-Hosted versions before v0.10.
diff --git a/src/langsmith/self-host-user-management.mdx b/src/langsmith/self-host-user-management.mdx
index 1bb16663..7da1cb87 100644
--- a/src/langsmith/self-host-user-management.mdx
+++ b/src/langsmith/self-host-user-management.mdx
@@ -4,7 +4,7 @@ sidebarTitle: Customize user management
---
- This guide assumes you have read the [admin guide](/langsmith/administration-overview) and [organization setup guide](/langsmith/set-up-organization).
+ This guide assumes you have read the [admin guide](/langsmith/administration-overview) and [organization setup guide](/langsmith/set-up-a-workspace#set-up-an-organization).
LangSmith offers additional customization features for user management using feature flags.
diff --git a/src/langsmith/set-up-a-workspace.mdx b/src/langsmith/set-up-a-workspace.mdx
new file mode 100644
index 00000000..33d2126c
--- /dev/null
+++ b/src/langsmith/set-up-a-workspace.mdx
@@ -0,0 +1,103 @@
+---
+title: Set up a workspace
+sidebarTitle: Set up a workspace
+---
+
+This page describes setting up and managing your LangSmith [_organization_](/langsmith/administration-overview#organizations) and [_workspaces_](/langsmith/administration-overview#workspaces):
+
+- [Set up an organization](#set-up-an-organization): Create and manage organizations for team collaboration, including user management and role assignments.
+- [Set up a workspace](#set-up-a-workspace): Set up and configure workspaces to organize your LangSmith resources, manage workspace members, and configure settings for team collaboration.
+
+
+You may find it helpful to refer to the [overview on LangSmith resource hierarchy](/langsmith/administration-overview) before you read this setup page.
+
+
+## Set up an organization
+
+
+If you're interested in managing your organization and workspaces programmatically, see [this how-to guide](/langsmith/manage-organization-by-api).
+
+
+### Create an organization
+
+When you log in for the first time, LangSmith will create a personal organization for you automatically. If you'd like to collaborate with others, you can create a separate organization and invite your team members to join.
+
+To do this, open the Organizations drawer by clicking your profile icon in the bottom left and click **+ New**. Shared organizations require a credit card before they can be used. You will need to [set up billing](/langsmith/billing#set-up-billing-for-your-account) to proceed.
+
+### Manage and navigate workspaces
+
+Once you've subscribed to a plan that allows for multiple users per organization, you can [set up workspaces](/langsmith/administration-overview#workspaces) to collaborate more effectively and isolate LangSmith resources between different groups of users. To navigate between workspaces and access the resources within each workspace (trace projects, annotation queues, etc.), select the desired workspace from the picker in the top left:
+
+
+
+### Manage users
+
+Manage membership in your shared organization in the **Members and roles** tabs on the [Settings page](https://smith.langchain.com/settings). Here you can:
+
+- Invite new users to your organization, selecting workspace membership and (if RBAC is enabled) workspace role.
+- Edit a user's organization role.
+- Remove users from your organization.
+
+
+
+Organizations on the Enterprise plan may set up custom workspace roles in the **Roles** tab. For more details, refer to the [access control setup guide](/langsmith/user-management).
+
+#### Organization roles
+
+Organization-scoped roles are used to determine access to organization settings. The role selected also impacts workspace membership:
+
+- `Organization Admin` grants full access to manage all organization configuration, users, billing, and workspaces. Any `Organization Admin` has `Admin` access to all workspaces in an organization.
+* `Organization User` may read organization information, but cannot execute any write actions at the organization level. You can add an `Organization User` to a subset of workspaces and assigned workspace roles as usual (if RBAC is enabled), which specify permissions at the workspace level.
+
+
+The `Organization User` role is only available in organizations on plans with multiple workspaces. In organizations limited to a single workspace, all users are `Organization Admins`. Custom organization-scoped roles are not available.
+
+
+For a full list of permissions associated with each role, refer to the [Administration overview](/langsmith/administration-overview#organization-roles) page.
+
+## Set up a workspace
+
+When you log in for the first time, a default [workspace](/langsmith/administration-overview#workspaces) will be created for you in your personal organization. Workspaces are often used to separate resources between different teams or business units to establish clear trust boundaries between them. Within each workspace, Role-Based Access Control (RBAC) manages permissions and access levels, which ensures that users only have access to the resources and settings necessary for their role. Most LangSmith activity happens in the context of a workspace, each of which has its own settings and access controls.
+
+To organize resources within a workspace, you can use [resource tags](/langsmith/set-up-resource-tags).
+
+### Create a workspace
+
+To create a new workspace, navigate to the [Settings page](https://smith.langchain.com/settings) **Workspaces** tab in your shared organization and click **Add Workspace**. Once you have created your workspace, you can manage its members and other configuration by selecting it on this page.
+
+
+
+
+Different plans have different limits placed on the number of workspaces that can be used in an organization. For more information, refer to the [pricing page](https://www.langchain.com/pricing-langsmith).
+
+
+### Manage users
+
+
+ Only workspace `Admins` can manage workspace membership and, if RBAC is enabled, change a user's workspace role.
+
+
+For users that are already members of an organization, a workspace `Admin` may add them to a workspace in the **Workspace members** tab under [Workspaces settings page](https://smith.langchain.com/settings/workspaces). Users may also be invited directly to one or more workspaces when they are [invited to an organization](#manage-users).
+
+### Configure workspace settings
+
+Workspace configuration exists in the [Workspaces settings page](https://smith.langchain.com/settings/workspaces) tab. Select the workspace to configure and then the desired configuration sub-tab. The following example shows the **API keys**, and other configuration options including secrets, models, and shared URLs are available here as well.
+
+
+
+### Delete a workspace
+
+
+Deleting a workspace will permanently delete the workspace and all associated data. This action cannot be undone.
+
+
+You can delete a workspace through the LangSmith UI or via [API](https://api.smith.langchain.com/redoc?#tag/workspaces/operation/delete_workspace_api_v1_workspaces__workspace_id__delete). You must be a workspace `Admin` in order to delete a workspace.
+
+### Delete a workspace via the UI
+
+1. Navigate to **Settings**.
+2. Select the workspace you want to delete.
+3. Click **Delete** in the top-right corner of the screen.
+
+
+
diff --git a/src/langsmith/set-up-access-control.mdx b/src/langsmith/set-up-access-control.mdx
deleted file mode 100644
index 6dc0adf0..00000000
--- a/src/langsmith/set-up-access-control.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: Set up access control
-sidebarTitle: Set up access control
----
-
-
- RBAC (Role-Based Access Control) is a feature that is only available to Enterprise customers. If you are interested in this feature, [contact our sales team](https://www.langchain.com/contact-sales). Other plans default to using the Admin role for all users. Read more about roles under [admin concepts](/langsmith/administration-overview)
-
-
-
- Before diving into this content, it might be helpful to read the following:
-
- * [Conceptual guide on organizations and workspaces](/langsmith/administration-overview)
-
-
-LangSmith relies on RBAC to manage user permissions **within a workspace**. This allows you to control who can access your LangSmith workspace and what they can do within it. Only users with the `workspace:manage` permission can manage access control settings for a workspace.
-
-## Create a role
-
-By default, LangSmith comes with a set of system roles:
-
-* `Admin` - has full access to all resources within the workspace
-* `Viewer` - has read-only access to all resources within the workspace
-* `Editor` - has full permissions except for workspace management (adding/removing users, changing roles, configuring service keys)
-
-If these do not fit your access model, Organization Admins can create custom roles to suit your needs.
-
-To create a role, navigate to the `Roles` tab in the `Members and roles` section of the [Organization settings page](https://smith.langchain.com/settings). Note that new roles that you create will be usable across all workspaces within your organization.
-
-Click on the `Create Role` button to create a new role. You should see a form like the one below:
-
-
-
-Assign permissions for the different LangSmith resources that you want to control access to.
-
-## Assign a role to a user
-
-Once you have your roles set up, you can assign them to users. To assign a role to a user, navigate to the `Workspace members` tab in the `Workspaces` section of the [Organization settings page](https://smith.langchain.com/settings)
-
-Each user will have a `Role` dropdown that you can use to assign a role to them.
-
-
-
-You can also invite new users with a given role.
-
-
diff --git a/src/langsmith/set-up-billing.mdx b/src/langsmith/set-up-billing.mdx
deleted file mode 100644
index 0df95a27..00000000
--- a/src/langsmith/set-up-billing.mdx
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: Set up billing for your account
-sidebarTitle: Set up billing
----
-
-
- If you are interested in the [Enterprise](https://www.langchain.com/pricing) plan, please [contact sales](https://www.langchain.com/contact-sales). This guide is only for our self-serve billing plans.
-
-
-
- If you created your LangSmith organization before pricing was introduced on April 2nd, 2024, please [skip to the final section](#set-up-billing-for-accounts-created-before-pricing-was-introduced-on-april-2-2024).
-
-
-To set up billing for your LangSmith organization, head to the [Usage and Billing](https://smith.langchain.com/settings/payments) page under Settings. Depending on your organization's settings, you will be given a different walkthrough to get started.
-
-## Developer Plan: set up billing on your personal organization
-
-Personal organizations are limited to 5000 traces per month until a credit card is added. You can add a credit card on the Plans and Billing page as follows:
-
-### 1. Click `Set up Billing`
-
-
-
-### 2. Add your credit card info
-
-After this step, you will no longer be rate limited to 5000 traces, and will be charged for any excess traces at rates specified on our [pricing](https://www.langchain.com/pricing-langsmith) page.
-
-## Plus Plan: set up billing on a shared organization
-
-If you have not yet created an organization, please do so by following [this guide](/langsmith/set-up-organization). This walkthrough assumes you are already in a new organization.
-
-
- New organizations are not usable until a credit card is entered. After you complete the following steps, you will gain complete access to LangSmith.
-
-
-### 1. Click `Subscribe` on the Plus page
-
-
- If you are a startup building with AI, please instead click `Apply Now` on our Startup Plan. You may be eligible for discounted prices and a generous free, monthly trace allotment.
-
-
-
-
-### 2. Review your existing members
-
-Before subscribing, LangSmith lets you remove any added users that you would not like to be charged for.
-
-
-
-### 3. Enter your credit card info
-
-#### Enter business information, invoice email and tax id
-
-If this organization belongs to a business. Please check the "This is a business" checkbox and enter the information accordingly.
-
-For more information refer to [this guide](/langsmith/update-business-info)
-
-Once this step is complete, your org should now have access to the rest of LangSmith!
-
-## Set up billing for accounts created before pricing was introduced on April 2, 2024
-
-If you joined LangSmith before pricing was introduced April 2, 2024, you have the option to upgrade your existing account to setup billing. If you did not set up billing by July 8, 2024, then your account is now rate limited to a maximum of 5,000 traces per month.
-
-### 1. Head to the [Settings page](https://smith.langchain.com/settings) page under Settings
-
-### 2. Click `Set up Billing`
-
-
-
-### 3. Enter your credit card info
-
-If you are on a Personal Organization, this will add you to the Developer plan. If you are on a shared Organization, this will add you to the Plus plan. For more information, please view the above walkthroughs for Developer or Plus respectively, starting at step 2.
-
-### 4. Claim free credits as a thank you for being an early LangSmith user
diff --git a/src/langsmith/set-up-organization.mdx b/src/langsmith/set-up-organization.mdx
deleted file mode 100644
index 1c79ed0c..00000000
--- a/src/langsmith/set-up-organization.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: Set up an organization
-sidebarTitle: Set up an organization
----
-
-
- Before diving into this content, it might be helpful to read the following:
-
- * [Conceptual guide on organizations and workspaces](/langsmith/administration-overview)
-
-
-
- If you're interested in managing your organization and workspaces programmatically, see [this how-to guide](/langsmith/manage-organization-by-api).
-
-
-## Create an organization
-
-When you log in for the first time, a personal organization will be created for you automatically. If you'd like to collaborate with others, you can create a separate organization and invite your team members to join.
-
-To do this, open the Organizations drawer by clicking your profile icon in the bottom left and click **+ New**. Shared organizations require a credit card before they can be used. You will need to [set up billing](/langsmith/set-up-billing) to proceed.
-
-## Manage and navigate workspaces
-
-Once you've subscribed to a plan that allows for multiple users per organization, you can [set up workspaces](/langsmith/set-up-workspace) to collaborate more effectively and isolate LangSmith resources between different groups of users. To navigate between workspaces and access the resources within each workspace (trace projects, annotation queues, etc.), select the desired workspace from the picker in the top left:
-
-
-
-## Manage users
-
-Manage membership in your shared organization in the [Settings page](https://smith.langchain.com/settings) `Members and roles` tab. Here you can
-
-* Invite new users to your organization, selecting workspace membership and (if RBAC is enabled) workspace role
-* Edit a user's organization role
-* Remove users from your organization
-
-
-
-Organizations on the Enterprise plan may set up custom workspace roles in the `Roles` tab here. See the [access control setup guide](/langsmith/set-up-access-control) for more details.
-
-### Organization roles
-
-These are organization-scoped roles that are used to determine access to organization settings. The role selected also impacts workspace membership as described here:
-
-* `Organization Admin` grants full access to manage all organization configuration, users, billing, and workspaces. **Any `Organization Admin` has `Admin` access to all workspaces in an organization**
-* `Organization User` may read organization information but cannot execute any write actions at the organization level. **An `Organization User` can be added to a subset of workspaces and assigned workspace roles as usual (if RBAC is enabled), which specify permissions at the workspace level.**
-
-
- The `Organization User` role is only available in organizations on plans with multiple workspaces. In organizations limited to a single workspace, all users are `Organization Admins`. Custom organization-scoped roles are not available yet.
-
-
-See [this conceptual guide](/langsmith/administration-overview#organization-roles) for a full list of permissions associated with each role.
diff --git a/src/langsmith/set-up-saml-sso.mdx b/src/langsmith/set-up-saml-sso.mdx
deleted file mode 100644
index c69b649d..00000000
--- a/src/langsmith/set-up-saml-sso.mdx
+++ /dev/null
@@ -1,266 +0,0 @@
----
-title: SAML SSO
-sidebarTitle: SAML SSO
----
-
-Single Sign-On (SSO) functionality is available for Enterprise Cloud customers to access LangSmith through a single authentication source. This allows administrators to centrally manage team access and keeps information more secure.
-
-LangSmith's SSO configuration is built using the SAML (Security Assertion Markup Language) 2.0 standard. SAML 2.0 enables connecting an Identity Provider (IdP) to your organization for an easier, more secure login experience.
-
-See [SCIM setup](/langsmith/set-up-scim) for instructions on using SCIM along with SAML for user provisioning and deprovisioning.
-
-
- SAML SSO is available for organizations on the [Enterprise plan](https://www.langchain.com/pricing-langsmith). Please [contact sales](https://www.langchain.com/contact-sales) to learn more.
-
-
-## What is SAML SSO?
-
-SSO services permit a user to use one set of credentials (for example, a name or email address and password) to access multiple applications. The service authenticates the end user only once for all the applications the user has been given rights to and eliminates further prompts when the user switches applications during the same session.
-
-## Benefits of SSO
-
-* Streamlines user management across systems for organization owners.
-* Enables organizations to enforce their own security policies (e.g. MFA)
-* Removes the need for end-users to remember and manage multiple passwords. Simplifies end-users experience by allowing them to sign in at one single access point and enjoy a seamless experience across multiple applications.
-
-## Set up SAML SSO for your organization
-
-### Prerequisites
-
-* Your organization must be on an Enterprise plan
-* Your Identity Provider (IdP) must support the SAML 2.0 standard
-* Only [Organization Admins](/langsmith/observability-overview#organization-roles) can configure SAML SSO
-
-### Initial configuration
-
-
- See IdP-specific instructions [below](#identity-provider-idp-setup)
-
-
-
- The URLs are different for the US and EU. Please make sure to select your region from the dropdown in the top right.
-
-
-1. In your IdP: Configure a SAML application with the following details, then copy the metadata URL or XML for step 3 below
-
- 1. Single sign-on URL a.k.a. ACS URL: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs)
- 2. Audience URI a.k.a. SP Entity ID: [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata)
- 3. Name ID format: email address
- 4. Application username: email address
- 5. Required claims: `sub` and `email`
-
-2. In LangSmith: Go to `Settings` -> `Members and roles` -> `SSO Configuration`
-
- 1. Fill in the required information and submit to activate SSO login
-
- 1. Fill in either the `SAML metadata URL` or `SAML metadata XML`
- 2. Select the `Default workspace role` and `Default workspaces`. New users logging in via SSO will be added to the specified workspaces with the selected role.
-
-### Editing SAML SSO settings
-
-* `Default workspace role` and `Default workspaces` are editable. The updated settings will apply to new users only, not existing users.
-* (Coming soon) `SAML metadata URL` and `SAML metadata XML` are editable. This is usually only necessary when cryptographic keys are rotated/expired or the metadata URL has changed but the same IdP is still used.
-
-## Just-in-time (JIT) provisioning
-
-LangSmith supports Just-in-Time provisioning when using SAML SSO. This allows someone signing in via SAML SSO to join the organization and selected workspaces automatically as a member.
-
-
- JIT provisioning only runs for new users i.e. users who do not already have access to the organization with the same email address via a [different login method](/langsmith/authentication-methods#cloud)
-
-
-## Login methods and access
-
-Once you have completed your configuration of SAML SSO for your organization, users will be able to login via SAML SSO in addition to [other login methods](/langsmith/authentication-methods#cloud) such as username/password and Google Authentication.
-
-* When logged in via SAML SSO, users can only access the corresponding organization with SAML SSO configured.
-* Users with SAML SSO as their only login method do not have [personal organizations](/langsmith/observability-overview#organizations)
-* When logged in via any other method, users can access the organization with SAML SSO configured along with any other organizations they are a part of
-
-## Enforce SAML SSO only
-
-To ensure users can only access the organization when logged in using SAML SSO and no other method, check the `Login via SSO only` checkbox and click `Save`. Once this happens, users accessing the organization that are logged-in via a non-SSO login method are required to log back in using SAML SSO. This setting can be switched back to allow all login methods by unselecting the checkbox and clicking `Save`.
-
-
- You must be logged in via SAML SSO in order to update this setting to `Only SAML SSO`. This is to ensure the SAML settings are valid and avoid locking users out of your organization.
-
-
-## Support and troubleshooting
-
-If you have issues setting up SAML SSO, please reach out to [support@langchain.dev](mailto:support@langchain.dev).
-
-### FAQ
-
-#### *How do I change a SAML SSO user's email address?*
-
-Some identity providers retain the original `User ID` through an email change while others do not, so we recommend that you follow these steps to avoid duplicate users in LangSmith:
-
-1. Remove the user from the organization (see [here](/langsmith/set-up-organization#manage-users))
-2. Change their email address in the IdP
-3. Have them login to LangSmith again via SAML SSO - this will trigger the usual [JIT provisioning](#just-in-time-jit-provisioning) flow with their new email address
-
-#### *How do I fix "405 method not allowed"?*
-
-Ensure you're using the correct ACS URL: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs)
-
-## Identity Provider (IdP) Setup
-
-These are instructions for setting up LangSmith SAML SSO with Entra ID (formerly Azure), Google, and Okta. If you use a different Identity Provider and need assistance with configuration, please contact our support team.
-
-### Entra ID (Azure)
-
-For additional information, see Microsoft's [documentation](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso).
-
-**Step 1: Create a new Entra ID application integration**
-
-1. Log in to the [Azure portal](https://portal.azure.com/#home) with a privileged role (e.g. Global Administrator). On the left navigation pane, select the `Entra ID` service.
-
-2. Navigate to Enterprise Applications and then select All Applications.
-
-3. Click `Create your own application`.
-
-4. In the Create your own application window:
-
- 1. Enter a name for your application (e.g. `LangSmith`)
- 2. Select `Integrate any other application you don't find in the gallery (Non-gallery)`.
-
-5. Click `Create`.
-
-**Step 2: Configure the Entra ID application and obtain the SAML Metadata**
-
-1. Open the enterprise application that you created.
-
-2. In the left-side navigation, select `Manage > Single sign-on`.
-
-3. On the Single sign-on page, click `SAML`.
-
-4. Update the `Basic SAML Configuration`
-
- 1. `Identifier (Entity ID)`: [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata)
- 2. `Reply URL (Assertion Consumer Service URL)`: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs)
- 3. Leave `Relay State`, `Logout Url`, and `Sign on URL` empty
- 4. Click `Save`
-
-5. Ensure required claims are present with `Namespace`: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims`
-
- 1. `sub`: `user.objectid`
- 2. `emailaddress`: `user.userprincipalname` or `user.mail` (if using the latter, ensure all users have the `Email` field filled in under `Contact Information`)
- 3. (Optional) For SCIM, see the [setup documentation](/langsmith/set-up-scim) for specific instructions about `Unique User Identifier (Name ID)`
-
-6. On the SAML-based Sign-on page, under `SAML Certificates`, copy the `App Federation Metadata Url`.
-
-**Step 3: Set up LangSmith SSO Configuration**
-
-Follow the instructions under [initial configuration](#initial-configuration) in the `Fill in required information` step, using the metadata URL from the previous step.
-
-**Step 4: Verify the SSO setup**
-
-1. Assign the application to users/groups in Entra ID
-
- 1. Select `Manage > Users and groups`
-
- 2. Click `Add user/group`
-
- 3. In the Add Assignment window:
-
- 1. Under Users, click `None Selected`.
- 2. Search for the user you want to assign to the enterprise application, and then click `Select`.
- 3. Verify that the user is selected, and click `Assign`.
-
-2. Have the user sign in via the unique login URL from the `SSO Configuration` page, or go to `Manage > Single sign-on` and select `Test single sign-on with `
-
-### Google
-
-For additional information, see Google's [documentation](https://support.google.com/a/answer/6087519).
-
-**Step 1: Create and configure the Google Workspace SAML application**
-
-1. Make sure you're signed into an administrator account with the appropriate permissions.
-
-2. In the Admin console, go to `Menu -> Apps -> Web and mobile apps`.
-
-3. Click `Add App` and then `Add custom SAML app`.
-
-4. Enter the app name and, optionally, upload an icon. Click `Continue`.
-
-5. On the Google Identity Provider details page, download the `IDP metadata` and save it for Step 2 below. Click Continue.
-
-6. In the `Service Provider Details` window, enter:
-
- 1. `ACS URL`: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs)
- 2. `Entity ID`: [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata)
- 3. Leave `Start URL` and the `Signed response` box empty.
- 4. Set `Name ID` format to `EMAIL` and leave `Name ID` as the default (`Basic Information > Primary email`).
- 5. Click `Continue`.
-
-7. Use `Add mapping` to ensure required claims are present:
- 1. `Basic Information > Primary email` -> `email`
-
-**Step 2: Set up LangSmith SSO Configuration**
-
-Follow the instructions under [initial configuration](#initial-configuration) in the `Fill in required information` step, using the `IDP metadata` from the previous step as the metadata XML.
-
-**Step 3: Turn on the SAML app in Google**
-
-1. Select the SAML app under `Menu -> Apps -> Web and mobile apps`
-
-2. Click `User access`.
-
-3. Turn on the service:
-
- 1. To turn the service on for everyone in your organization, click `On for everyone`, and then click `Save`.
-
- 2. To turn the service on for an organizational unit:
-
- 1. At the left, select the organizational unit then `On`.
- 2. If the Service status is set to `Inherited` and you want to keep the updated setting, even if the parent setting changes, click `Override`.
- 3. If the Service status is set to `Overridden`, either click `Inherit` to revert to the same setting as its parent, or click `Save` to keep the new setting, even if the parent setting changes.
-
- 3. To turn on a service for a set of users across or within organizational units, select an access group. For details, go to [Use groups to customize service access](https://support.google.com/a/answer/9050643).
-
-4. Ensure that the email addresses your users use to sign in to LangSmith match the email addresses they use to sign in to your Google domain.
-
-**Step 4: Verify the SSO setup**
-
-Have a user with access sign in via the unique login URL from the `SSO Configuration` page, or go to the SAML application page in Google and click `TEST SAML LOGIN`.
-
-### Okta
-
-For additional information, see Okta's [documentation](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm).
-
-**Step 1: Create and configure the Okta SAML application**
-
-1. Log in to Okta as an administrator, and go to the `Okta Admin console`.
-
-2. Under `Applications > Applications` click `Create App Integration`
-
-3. Select `SAML 2.0`
-
-4. Enter an `App name` (e.g. `LangSmith`) and optionally an `App logo`, then click `Next`
-
-5. Enter the following information in the `Configure SAML` page:
-
- 1. `Single sign-on URL` a.k.a. `ACS URL`: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs). Keep `Use this for Recipient URL and Destination URL` checked.
- 2. `Audience URI (SP Entity ID)`: [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata)
- 3. `Name ID format`: `EmailAddress`
- 4. `Application username`: `email`
- 5. Leave the rest of the fields empty or set to their default.
- 6. Click \`Next
-
-6. Click `Finish`
-
-7. Copy the `Metadata URL` from the `Sign On` page to use in the next step
-
-**Step 2: Set up LangSmith SSO Configuration**
-
-Follow the instructions under [initial configuration](#initial-configuration) in the `Fill in required information` step, using the metadata URL from the previous step.
-
-**Step 3: Assign users to LangSmith in Okta**
-
-1. Under `Applications > Applications`, select the SAML application created in Step 1
-2. Under the `Assignments` tab, click `Assign` then either `Assign to People` or `Assign to Groups`
-3. Make the desired selection(s), then `Assign` and `Done`
-
-**Step 4: Verify the SSO setup**
-
-Have a user with access sign in via the unique login URL from the `SSO Configuration` page, or have a user select the application from their Okta dashboard.
diff --git a/src/langsmith/set-up-scim.mdx b/src/langsmith/set-up-scim.mdx
deleted file mode 100644
index 7129fe63..00000000
--- a/src/langsmith/set-up-scim.mdx
+++ /dev/null
@@ -1,247 +0,0 @@
----
-title: SCIM User Provisioning (Beta)
-sidebarTitle: SCIM User Provisioning (Beta)
----
-
-System for Cross-domain Identity Management (SCIM) is an open standard that allows for the automation of user provisioning. Using SCIM, you can automatically provision and deprovision users in your LangSmith organization and workspaces, keeping user access synchronized with your organization's identity provider.
-
-
- SCIM is available for organizations on the [Enterprise plan](https://www.langchain.com/pricing). Please [contact sales](https://www.langchain.com/contact-sales) to learn more.
-
- SCIM is available on Helm chart versions 0.10.41 (application version 0.10.108) and later.
-
- While in Beta, SCIM support is API-only (see instructions below).
-
-
-## What is SCIM?
-
-SCIM enables automatic user provisioning and deprovisioning between your identity provider (IdP) and LangSmith. This eliminates the need for manual user management and ensures that user access is always up-to-date with your organization's identity system.
-
-## Benefits of SCIM
-
-* **Automated user management**: Users are automatically added, updated, and removed from LangSmith based on their status in your IdP
-* **Reduced administrative overhead**: No need to manually manage user access across multiple systems
-* **Improved security**: Users who leave your organization are automatically deprovisioned from LangSmith
-* **Consistent access control**: User attributes and group memberships are synchronized between systems
-* **Scalable**: Efficiently manage large teams with many workspaces and custom roles
-
-## Prerequisites
-
-* Your organization must be on an Enterprise plan
-* Your Identity Provider (IdP) must support SCIM 2.0
-* Only [Organization Admins](/langsmith/observability-overview#organization-roles) can configure SCIM
-* For cloud customers: [SAML SSO](/langsmith/set-up-saml-sso) must be configured for your organization
-* For self-hosted customers: [OAuth with Client Secret](/langsmith/self-host-sso#with-secret) authentication mode must be enabled
-
-## Capabilities
-
-SCIM enables the following capabilities:
-
-* **User provisioning**: Automatically add users to your LangSmith organization
-* **User deprovisioning**: Automatically remove users from your organization
-* **Attribute synchronization**: Keep user attributes (like full name) synchronized between your IdP and LangSmith
-* **Group-based access**: Sync membership from IdP user groups to LangSmith workspaces
-* **Role assignment**: Select specific [Organization Roles](/langsmith/observability-overview#organization-roles) and [Workspace Roles](/langsmith/observability-overview#workspace-roles) for groups of users
-
-## Role Precedence
-
-When a user belongs to multiple groups for the same workspace, the following precedence applies:
-
-1. **Organization Admin groups** take highest precedence - users in these groups will be `Admin` in all workspaces
-2. **Most recently-created workspace-specific group** takes precedence over other workspace groups
-
-
- When a group is deleted or a user is removed from a group, their access is updated according to their remaining group membership, following the precedence rules above.
-
- SCIM group membership will override manually-assigned roles or roles assigned via Just-in-Time (JIT) provisioning. We recommend disabling JIT provisioning to avoid conflicts.
-
-
-## Group Naming Convention
-
-Group membership maps to LangSmith Workspace membership and workspace roles with a specific naming convention:
-
-### Organization Admin Groups
-
-Format: `Organization Admin` or `Organization Admins`
-
-Examples:
-
-* `LS:Organization Admins`
-* `Groups-Organization Admins`
-* `Organization Admin`
-
-### Workspace-Specific Groups
-
-Format: `::`
-
-Examples:
-
-* `LS:Organization User:Production:Annotators`
-* `Groups-Organization User:Engineering:Developers`
-* `Organization User:Marketing:Viewers`
-
-## Email verification
-
-In cloud only, creating a new user with SCIM triggers an email to the user. They must verify their email address by clicking the link in this email. The link expires in 24 hours, and can be resent if needed by removing and re-adding the user via SCIM.
-
-## Set up SCIM for your organization
-
-### Step 1: Configure SAML SSO (Cloud only)
-
-If you're using LangSmith Cloud, ensure [SAML SSO](/langsmith/set-up-saml-sso) is configured for your organization.
-
-#### NameID Format
-
-LangSmith uses the SAML NameID to identify users. The NameID is a required field in the SAML response and is case-insensitive.
-
-The NameID must:
-
-1. Be unique to each user.
-2. Be a persistent value that never changes, such as a randomly generated unique user ID.
-3. Match exactly on each sign-in attempt. It should not rely on user input.
-
-The NameID should not be an email address or username because Email addresses and usernames are more likely to change over time and can be case-sensitive.
-
-The NameID format must be `Persistent`, unless you are using a field, like email, that requires a different format.
-
-### Step 2: Disable JIT Provisioning (Cloud only)
-
-Before enabling SCIM, disable [Just-in-Time (JIT) provisioning](/langsmith/set-up-saml-sso#just-in-time-jit-provisioning) to prevent conflicts between automatic and manual user provisioning. Use the `PATCH /orgs/current/info` [endpoint](https://api.smith.langchain.com/redoc#tag/orgs/operation/update_current_organization_info_api_v1_orgs_current_info_patch):
-
-```bash
-curl -X PATCH $LANGCHAIN_ENDPOINT/orgs/current/info \
- -H "X-Api-Key: $LANGCHAIN_API_KEY" \
- -H "Content-Type: application/json" \
- -d '{"jit_provisioning_enabled": false}'
-```
-
-### Step 3: Generate SCIM Bearer Token
-
-Generate a SCIM Bearer Token for your organization. This token will be used by your IdP to authenticate SCIM API requests. Ensure env vars are set appropriately, for example:
-
-```bash
-curl -X POST $LANGCHAIN_ENDPOINT/v1/platform/orgs/current/scim/tokens \
- -H "X-Api-Key: $LANGCHAIN_API_KEY" \
- -H "X-Organization-Id: $LANGCHAIN_ORGANIZATION_ID" \
- -H "Content-Type: application/json" \
- -d '{"description": "Your description here"}'
-```
-
-Note that the SCIM Bearer Token value is not available outside of the response to this request. These additional endpoints are present:
-
-* `GET /v1/platform/orgs/current/scim/tokens`
-* `GET /v1/platform/orgs/current/scim/tokens/{scim_token_id}`
-* `PATCH /v1/platform/orgs/current/scim/tokens/{scim_token_id}` (only the `description` field is supported)
-* `DELETE /v1/platform/orgs/current/scim/tokens/{scim_token_id}`
-
-### Step 4: Configure your Identity Provider
-
-Follow the IdP-specific instructions below to configure SCIM integration.
-
-## Identity Provider (IdP) Setup
-
-### Azure Entra ID
-
-For additional information, see Microsoft's [documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning).
-
-**Step 1: Configure SCIM in your Enterprise Application**
-
-1. Log in to the [Azure portal](https://portal.azure.com/#home) with a privileged role (e.g. Global Administrator)
-2. Navigate to your existing LangSmith Enterprise Application
-3. In the left-side navigation, select `Manage > Provisioning`
-4. Click `Get started`
-
-**Step 2: Configure Admin Credentials**
-
-1. Under `Admin Credentials`:
-
- * **Tenant URL**:
-
- * US: `https://api.smith.langchain.com/scim/v2`
- * EU: `https://eu.api.smith.langchain.com/scim/v2`
- * Self-hosted: `/scim/v2`
-
- * **Secret Token**: Enter the SCIM Bearer Token generated in Step 3 above
-
-2. Click `Test Connection` to verify the configuration
-
-3. Click `Save`
-
-**Step 3: Configure Attribute Mappings**
-
-Configure the following attribute mappings under `Mappings`:
-
-**User Attributes**
-
-Set `Target Object Actions` to `Create` and `Update` (start with `Delete` disabled for safety):
-
-| **LangSmith App Attribute** | **Microsoft Entra ID Attribute** | **Matching Precedence** |
-| ------------------------------ | ----------------------------------------------------- | ----------------------- |
-| `userName` | `userPrincipalName` | |
-| `active` | `Not([IsSoftDeleted])` | |
-| `emails[type eq "work"].value` | `mail`1 | |
-| `name.formatted` | `displayName` OR `Join(" ", [givenName], [surname])`2 | |
-| `externalId` | `objectId`3 | 1 |
-
-1. User's email address must be present in Entra ID
-2. Use the `Join` expression if your `displayName` does not match the format of `Firstname Lastname`
-3. To avoid inconsistency, this should match the SAML NameID assertion and the `sub` OAuth2.0 claim. For SAML SSO in cloud, the `Unique User Identifier (Name ID)` required claim should be `user.objectID` and the `Name identifier format` should be `persistent`.
-
-**Group Attributes**
-
-Set `Target Object Actions` to `Create` and `Update` only (start with `Delete` disabled for safety):
-
-| **LangSmith App Attribute** | **Microsoft Entra ID Attribute** | **Matching Precedence** |
-| --------------------------- | -------------------------------- | ----------------------- |
-| `displayName` | `displayname`1 | 1 |
-| `externalId` | `objectId` | |
-| `members` | `members` | |
-
-1. Groups must follow the naming convention described in the [Azure Group Naming Convention](#group-naming-convention) section
-
-**Step 4: Assign Users and Groups**
-
-1. Under `Applications > Applications`, select your LangSmith Enterprise Application
-2. Under the `Assignments` tab, click `Assign` then either `Assign to People` or `Assign to Groups`
-3. Make the desired selection(s), then `Assign` and `Done`
-
-**Step 5: Enable Provisioning**
-
-1. Set `Provisioning Status` to `On` under `Provisioning`
-2. Monitor the initial sync to ensure users and groups are provisioned correctly
-3. Once verified, enable `Delete` actions for both User and Group mappings
-
-### Okta
-
-Support for Okta is not yet released. If you are interested in using Okta with SCIM, please let us know at [support@langchain.dev](mailto:support@langchain.dev).
-
-### Other Identity Providers
-
-Other identity providers have not been tested but may function depending on their SCIM implementation.
-
-## Support and troubleshooting
-
-If you have issues setting up SCIM, please reach out to [support@langchain.dev](mailto:support@langchain.dev).
-
-### FAQ
-
-#### *Can I use SCIM without SAML SSO?*
-
-* **Cloud**: No, SAML SSO is required for SCIM in cloud deployments
-* **Self-hosted**: Yes, SCIM works with OAuth with Client Secret authentication mode
-
-#### *What happens if I have both JIT provisioning and SCIM enabled?*
-
-JIT provisioning and SCIM can conflict with each other. We recommend disabling JIT provisioning before enabling SCIM to ensure consistent user provisioning behavior.
-
-#### *How do I change a user's role or workspace access?*
-
-Update the user's group membership in your IdP. The changes will be synchronized to LangSmith according to the [role precedence rules](#role-precedence).
-
-#### *What happens when a user is removed from all groups?*
-
-The user will be deprovisioned from your LangSmith organization according to your IdP's deprovisioning settings.
-
-#### *Can I use custom group names?*
-
-No, groups must follow the specific naming convention described in the [Group Naming Convention](#group-naming-convention) section to properly map to LangSmith roles and workspaces.
diff --git a/src/langsmith/set-up-workspace.mdx b/src/langsmith/set-up-workspace.mdx
deleted file mode 100644
index 1a6ca986..00000000
--- a/src/langsmith/set-up-workspace.mdx
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: Set up a workspace
-sidebarTitle: Set up a workspace
----
-
-
- Before diving into this content, it might be helpful to read the following:
-
- * [Conceptual guide on organizations and workspaces](/langsmith/administration-overview)
-
-
-When you log in for the first time, a default [workspace](/langsmith/administration-overview#workspaces) will be created for you automatically in your [personal organization](/langsmith/set-up-organization#personal-vs-shared-organizations). Workspaces are often used to separate resources between different teams or business units, ensuring clear trust boundaries between them. Within each workspace, Role-Based Access Control (RBAC) is implemented to manage permissions and access levels, ensuring that users only have access to the resources and settings necessary for their role. Most LangSmith activity happens in the context of a workspace, each of which has its own settings and access controls.
-
-To organize resources *within* a workspace, you can use [resource tags](/langsmith/set-up-resource-tags).
-
-## Create a workspace
-
-To create a new workspace, head to the [Settings page](https://smith.langchain.com/settings) `Workspaces` tab in your shared organization and click **Add Workspace**. Once your workspace has been created, you can manage its members and other configuration by selecting it on this page.
-
-
-
-
- Different plans have different limits placed on the number of workspaces that can be used in an organization. Please see the [pricing page](https://www.langchain.com/pricing-langsmith) for more information.
-
-
-## Manage users
-
-
- Only workspace `Admins` may manage workspace membership and, if RBAC is enabled, change a user's workspace role.
-
-
-For users that are already members of an organization, a workspace admin may add them to a workspace in the `Workspace members` tab under [workspace settings page](https://smith.langchain.com/settings/workspaces). Users may also be invited directly to one or more workspaces when they are [invited to an organization](/langsmith/set-up-organization#manage-users).
-
-## Configure workspace settings
-
-Workspace configuration exists in the [workspace settings page](https://smith.langchain.com/settings/workspaces) tab. Select the workspace to configure and then the desired configuration sub-tab. The example below shows the `API keys`, and other configuration options including secrets, models, and shared URLs are available here as well.
-
-
-
-## Delete a workspace
-
-
- Deleting a workspace will permanently delete the workspace and all associated data. This action cannot be undone.
-
-
-Workspaces can be deleted through the LangSmith UI or via [API](https://api.smith.langchain.com/redoc?#tag/workspaces/operation/delete_workspace_api_v1_workspaces__workspace_id__delete). You must be a workspace admin in order to delete a workspace.
-
-#### Deleting a workspace via the UI
-
-1. Navigate to **Settings**.
-2. Select the workspace you want to delete.
-3. Click **Delete** in the top-right corner of the screen.
-
-
diff --git a/src/langsmith/update-business-info.mdx b/src/langsmith/update-business-info.mdx
deleted file mode 100644
index 2ed039c2..00000000
--- a/src/langsmith/update-business-info.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: Update invoice email, tax id and, business information
-sidebarTitle: Update information
----
-
-To update business information for your LangSmith organization, head to the [Usage and Billing](https://smith.langchain.com/settings/payments) page under Settings and click on the [Plans and Billing](https://smith.langchain.com/settings/payments?tab=2) tab.
-
-
- Business information, tax id and invoice email can only be updated for the plus and start up plans. Free and developer plans cannot update this information.
-
-
-## Update invoice email
-
-
-
-To update the email address where your invoices are sent, follow these steps:
-
-1. Navigate to the Plans and Billing tab.
-2. Locate the section beneath the payment method, where the current invoice email is displayed.
-3. Enter the new email address you want invoices to be sent to in the provided field.
-4. The new email address will be automatically saved.
-
-This ensures that all future invoices will be sent to the updated email address.
-
-## Update business information and tax id
-
-
- In certain jurisdictions, LangSmith is required to collect sales tax. If you are a business, providing your Tax ID may qualify you for a sales tax exemption.
-
-
-
-
-To update your organization's business information, follow these steps:
-
-1. Navigate to the Plans and Billing tab.
-
-2. Below the invoice email section, you will find a checkbox labeled Business.
-
-3. Check the Business checkbox if your organization belongs to a business.
-
-4. A business information section will appear, allowing you to enter or update the following details:
-
- * Business Name
- * Address
- * Tax ID for applicable jurisdictions
-
-5. Tax ID field will appear for applicable jurisdictions after you select a country.
-
-6. After entering the necessary information, click the Save button to save your changes.
-
-This ensures that your business information is up-to-date and accurate for billing and tax purposes.
diff --git a/src/langsmith/user-management.mdx b/src/langsmith/user-management.mdx
new file mode 100644
index 00000000..44c143b7
--- /dev/null
+++ b/src/langsmith/user-management.mdx
@@ -0,0 +1,490 @@
+---
+title: User management
+sidebarTitle: User management
+---
+
+This page covers user management features in LangSmith, including access control, authentication, and automated user provisioning:
+
+- [Set up access control](#user-management): Configure role-based access control (RBAC) to manage user permissions within workspaces, including creating custom roles and assigning them to users.
+- [SAML SSO (Enterprise plan)](#saml-sso): Set up Single Sign-On authentication for Enterprise customers using SAML 2.0, including configuration for popular identity providers.
+- [SCIM User Provisioning (Enterprise plan, Beta)](#scim-user-provisioning-beta): Automate user provisioning and deprovisioning between your identity provider and LangSmith using SCIM.
+
+## Set up access control
+
+
+RBAC (Role-Based Access Control) is a feature that is only available to Enterprise customers. If you are interested in this feature, contact the LangChain sales team at [sales@langchain.dev](mailto:sales@langchain.dev). Other plans default to using the [`Admin` role](/langsmith/administration-overview) for all users.
+
+
+
+You may find it helpful to read the [Administration overview](/langsmith/administration-overview) page before setting up access control.
+
+
+LangSmith relies on RBAC to manage user permissions within a [workspace](/langsmith/administration-overview#workspaces). This allows you to control who can access your LangSmith workspace and what they can do within it. Only users with the `workspace:manage` permission can manage access control settings for a workspace.
+
+### Create a role
+
+By default, LangSmith comes with a set of system roles:
+
+- `Admin`: has full access to all resources within the workspace.
+- `Viewer`: has read-only access to all resources within the workspace.
+- `Editor`: has full permissions except for workspace management (adding/removing users, changing roles, configuring service keys).
+
+If these do not fit your access model, `Organization Admins` can create custom roles to suit your needs.
+
+To create a role, navigate to the **Roles** tab in the **Members and roles** section of the [Organization settings page](https://smith.langchain.com/settings). Note that new roles that you create will be usable across all workspaces within your organization.
+
+Click on the **Create Role** button to create a new role. A **Create role** form will open.
+
+
+
+Assign permissions for the different LangSmith resources that you want to control access to.
+
+### Assign a role to a user
+
+Once you have your roles set up, you can assign them to users. To assign a role to a user, navigate to the `Workspace members` tab in the `Workspaces` section of the [Organization settings page](https://smith.langchain.com/settings)
+
+Each user will have a **Role** dropdown that you can use to assign a role to them.
+
+
+
+You can also invite new users with a given role.
+
+
+
+## Set up SAML SSO for your organization
+
+Single Sign-On (SSO) functionality is **available for Enterprise Cloud** customers to access LangSmith through a single authentication source. This allows administrators to centrally manage team access and keeps information more secure.
+
+LangSmith's SSO configuration is built using the SAML (Security Assertion Markup Language) 2.0 standard. SAML 2.0 enables connecting an Identity Provider (IdP) to your organization for an easier, more secure login experience.
+
+SSO services permit a user to use one set of credentials (for example, a name or email address and password) to access multiple applications. The service authenticates the end user only once for all the applications the user has been given rights to and eliminates further prompts when the user switches applications during the same session. The benefits of SSO include:
+
+- Streamlines user management across systems for organization owners.
+- Enables organizations to enforce their own security policies (e.g., MFA).
+- Removes the need for end users to remember and manage multiple passwords. Simplifies the end-user experience, by allowing sign in at one single access point across multiple applications.
+
+### Prerequisites
+
+
+SAML SSO is available for organizations on the [Enterprise plan](https://www.langchain.com/pricing-langsmith). Please [contact sales](https://www.langchain.com/contact-sales) to learn more.
+
+
+- Your organization must be on an Enterprise plan.
+- Your Identity Provider (IdP) must support the SAML 2.0 standard.
+- Only [`Organization Admins`](/langsmith/observability-overview#organization-roles) can configure SAML SSO.
+
+For instructions on using SCIM along with SAML for user provisioning and deprovisioning, refer to the [SCIM setup](#user-management).
+
+### Initial configuration
+
+
+ See IdP-specific instructions [below](#identity-provider-idp-setup)
+
+
+
+The URLs are different for the US and EU. Ensure you select your region from the dropdown in the top right.
+
+
+1. In your IdP: Configure a SAML application with the following details, then copy the metadata URL or XML for step 3.
+
+ 1. Single sign-on URL (or ACS URL): [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs).
+ 2. Audience URI (or SP Entity ID): [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata)
+ 3. Name ID format: email address.
+ 4. Application username: email address.
+ 5. Required claims: `sub` and `email`.
+
+2. In LangSmith: Go to **Settings** -> **Members and roles** -> **SSO Configuration**. Fill in the required information and submit to activate SSO login:
+
+ 1. Fill in either the `SAML metadata URL` or `SAML metadata XML`.
+ 2. Select the `Default workspace role` and `Default workspaces`. New users logging in via SSO will be added to the specified workspaces with the selected role.
+
+- `Default workspace role` and `Default workspaces` are editable. The updated settings will apply to new users only, not existing users.
+- (Coming soon) `SAML metadata URL` and `SAML metadata XML` are editable. This is usually only necessary when cryptographic keys are rotated/expired or the metadata URL has changed but the same IdP is still used.
+
+### Just-in-time (JIT) provisioning
+
+LangSmith supports Just-in-Time provisioning when using SAML SSO. This allows someone signing in via SAML SSO to join the organization and selected workspaces automatically as a member.
+
+
+JIT provisioning only runs for new users, that is, users who do not already have access to the organization with the same email address via a [different login method](/langsmith/authentication-methods#cloud).
+
+
+### Login methods and access
+
+Once you have completed your configuration of SAML SSO for your organization, users will be able to log in via SAML SSO in addition to [other login methods](/langsmith/authentication-methods#cloud), such as username/password and Google Authentication":
+
+- When logged in via SAML SSO, users can only access the corresponding organization with SAML SSO configured.
+- Users with SAML SSO as their only login method do not have [personal organizations](/langsmith/administration-overview#organizations).
+- When logged in via any other method, users can access the organization with SAML SSO configured along with any other organizations they are a part of.
+
+### Enforce SAML SSO only
+
+To ensure users can only access the organization when logged in using SAML SSO and no other method, check the **Login via SSO only** checkbox and click **Save**. Once this happens, users accessing the organization that are logged-in via a non-SSO login method are required to log back in using SAML SSO. This setting can be switched back to allow all login methods by unselecting the checkbox and clicking **Save**.
+
+
+You must be logged in via SAML SSO in order to update this setting to `Only SAML SSO`. This is to ensure the SAML settings are valid and avoid locking users out of your organization.
+
+
+For troubleshooting, refer to the [SAML SSO FAQs](/langsmith/faq#saml-sso-faqs). If you have issues setting up SAML SSO, reach out to the LangChain support team at [support@langchain.dev](mailto:support@langchain.dev).
+
+### Identity Provider (IdP) Setup
+
+These are instructions for setting up LangSmith SAML SSO with Entra ID (formerly Azure), Google, and Okta. If you use a different Identity Provider and need assistance with configuration, contact the [LangChain support team](mailto:support@langchain.dev).
+
+#### Entra ID (Azure)
+
+For additional information, see Microsoft's [documentation](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso).
+
+**Step 1: Create a new Entra ID application integration**
+
+1. Log in to the [Azure portal](https://portal.azure.com/#home) with a privileged role (e.g., `Global Administrator`). On the left navigation pane, select the `Entra ID` service.
+
+2. Navigate to **Enterprise Applications** and then select **All Applications**.
+
+3. Click **Create your own application**.
+
+4. In the **Create your own application** window:
+
+ 1. Enter a name for your application (e.g., `LangSmith`).
+ 2. Select *Integrate any other application you don't find in the gallery (Non-gallery)**.
+
+5. Click **Create**.
+
+**Step 2: Configure the Entra ID application and obtain the SAML Metadata**
+
+1. Open the enterprise application that you created.
+
+2. In the left-side navigation, select **Manage** > **Single sign-on**.
+
+3. On the Single sign-on page, click **SAML**.
+
+4. Update the **Basic SAML Configuration**:
+
+ 1. `Identifier (Entity ID)`: [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata).
+ 2. `Reply URL (Assertion Consumer Service URL)`: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs).
+ 3. Leave `Relay State`, `Logout Url`, and `Sign on URL` empty.
+ 4. Click **Save**.
+
+5. Ensure required claims are present with **Namespace**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims`:
+
+ 1. `sub`: `user.objectid`.
+ 2. `emailaddress`: `user.userprincipalname` or `user.mail` (if using the latter, ensure all users have the `Email` field filled in under `Contact Information`).
+ 3. (Optional) For SCIM, see the [setup documentation](/langsmith/user-management) for specific instructions about `Unique User Identifier (Name ID)`.
+
+6. On the SAML-based Sign-on page, under **SAML Certificates**, copy the **App Federation Metadata URL**.
+
+**Step 3: Set up LangSmith SSO Configuration**
+
+Follow the instructions under [initial configuration](#initial-configuration) in the `Fill in required information` step, using the metadata URL from the previous step.
+
+**Step 4: Verify the SSO setup**
+
+1. Assign the application to users/groups in Entra ID:
+
+ 1. Select **Manage** > **Users and groups**.
+
+ 2. Click **Add user/group**.
+
+ 3. In the **Add Assignment** window:
+
+ 1. Under **Users**, click **None Selected**.
+ 2. Search for the user you want to assign to the enterprise application, and then click **Select**.
+ 3. Verify that the user is selected, and click **Assign**.
+
+2. Have the user sign in via the unique login URL from the **SSO Configuration** page, or go to **Manage** > **Single sign-on** and select **Test single sign-on with (application name)**.
+
+#### Google
+
+For additional information, see Google's [documentation](https://support.google.com/a/answer/6087519).
+
+**Step 1: Create and configure the Google Workspace SAML application**
+
+1. Make sure you're signed into an administrator account with the appropriate permissions.
+
+2. In the Admin console, go to **Menu** -> **Apps** -> **Web and mobile apps**.
+
+3. Click **Add App** and then **Add custom SAML app**.
+
+4. Enter the app name and, optionally, upload an icon. Click **Continue**.
+
+5. On the Google Identity Provider details page, download the **IDP metadata** and save it for Step 2. Click **Continue**.
+
+6. In the `Service Provider Details` window, enter:
+
+ 1. `ACS URL`: [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs)
+ 2. `Entity ID`: [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata)
+ 3. Leave `Start URL` and the `Signed response` box empty.
+ 4. Set `Name ID` format to `EMAIL` and leave `Name ID` as the default (`Basic Information > Primary email`).
+ 5. Click `Continue`.
+
+7. Use `Add mapping` to ensure required claims are present:
+ 1. `Basic Information > Primary email` -> `email`
+
+**Step 2: Set up LangSmith SSO Configuration**
+
+Follow the instructions under [initial configuration](#initial-configuration) in the `Fill in required information` step, using the `IDP metadata` from the previous step as the metadata XML.
+
+**Step 3: Turn on the SAML app in Google**
+
+1. Select the SAML app under `Menu -> Apps -> Web and mobile apps`
+
+2. Click `User access`.
+
+3. Turn on the service:
+
+ 1. To turn the service on for everyone in your organization, click `On for everyone`, and then click `Save`.
+
+ 2. To turn the service on for an organizational unit:
+
+ 1. At the left, select the organizational unit then `On`.
+ 2. If the Service status is set to `Inherited` and you want to keep the updated setting, even if the parent setting changes, click `Override`.
+ 3. If the Service status is set to `Overridden`, either click `Inherit` to revert to the same setting as its parent, or click `Save` to keep the new setting, even if the parent setting changes.
+
+ 3. To turn on a service for a set of users across or within organizational units, select an access group. For details, go to [Use groups to customize service access](https://support.google.com/a/answer/9050643).
+
+4. Ensure that the email addresses your users use to sign in to LangSmith match the email addresses they use to sign in to your Google domain.
+
+**Step 4: Verify the SSO setup**
+
+Have a user with access sign in via the unique login URL from the **SSO Configuration** page, or go to the SAML application page in Google and click **TEST SAML LOGIN**.
+
+#### Okta
+
+For additional information, see Okta's [documentation](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm).
+
+**Step 1: Create and configure the Okta SAML application**
+
+1. Log in to Okta as an administrator, and go to the **Okta Admin console**.
+
+2. Under **Applications** > **Applications** click **Create App Integration**.
+
+3. Select **SAML 2.0**.
+
+4. Enter an `App name` (e.g., `LangSmith`) and optionally an **App logo**, then click **Next**.
+
+5. Enter the following information in the **Configure SAML** page:
+
+ 1. `Single sign-on URL` (`ACS URL`): [https://auth.langchain.com/auth/v1/sso/saml/acs](https://auth.langchain.com/auth/v1/sso/saml/acs). Keep `Use this for Recipient URL and Destination URL` checked.
+ 2. `Audience URI (SP Entity ID)`: [https://auth.langchain.com/auth/v1/sso/saml/metadata](https://auth.langchain.com/auth/v1/sso/saml/metadata).
+ 3. `Name ID format`: `EmailAddress`.
+ 4. `Application username`: `email`.
+ 5. Leave the rest of the fields empty or set to their default.
+ 6. Click **Next**.
+
+6. Click **Finish**.
+
+7. Copy the **Metadata URL** from the **Sign On** page to use in the next step.
+
+**Step 2: Set up LangSmith SSO Configuration**
+
+Follow the instructions under [initial configuration](#initial-configuration) in the **Fill in required information** step, using the metadata URL from the previous step.
+
+**Step 3: Assign users to LangSmith in Okta**
+
+1. Under **Applications** > **Applications**, select the SAML application created in Step 1.
+2. Under the **Assignments** tab, click **Assign** then either **Assign to People** or **Assign to Groups**.
+3. Make the desired selection(s), then **Assign** and **Done**.
+
+**Step 4: Verify the SSO setup**
+
+Have a user with access sign in via the unique login URL from the `SSO Configuration` page, or have a user select the application from their Okta dashboard.
+
+## Set up SCIM for your organization (beta)
+
+System for Cross-domain Identity Management (SCIM) is an open standard that allows for the automation of user provisioning. Using SCIM, you can automatically provision and de-provision users in your LangSmith [organization and workspaces](/langsmith/administration-overview), keeping user access synchronized with your organization's identity provider.
+
+
+SCIM is available for organizations on the [Enterprise plan](https://www.langchain.com/pricing). [Contact sales](https://www.langchain.com/contact-sales) to learn more.
+
+SCIM is available on Helm chart versions 0.10.41 (application version 0.10.108) and later.
+
+While in Beta, SCIM support is API-only (see instructions below).
+
+
+SCIM eliminates the need for manual user management and ensures that user access is always up-to-date with your organization's identity system. This allows for:
+
+- **Automated user management**: Users are automatically added, updated, and removed from LangSmith based on their status in your IdP.
+- **Reduced administrative overhead**: No need to manage user access manually across multiple systems.
+- **Improved security**: Users who leave your organization are automatically deprovisioned from LangSmith.
+- **Consistent access control**: User attributes and group memberships are synchronized between systems.
+- **Scaling team access control**: Efficiently manage large teams with many workspaces and custom roles.
+- **Role assignment**: Select specific [Organization Roles](/langsmith/observability-overview#organization-roles) and [Workspace Roles](/langsmith/observability-overview#workspace-roles) for groups of users.
+
+### Role Precedence
+
+When a user belongs to multiple groups for the same workspace, the following precedence applies:
+
+1. **Organization Admin groups** take highest precedence. Users in these groups will be `Admin` in all workspaces.
+2. **Most recently created workspace-specific group** takes precedence over other workspace groups.
+
+
+When a group is deleted or a user is removed from a group, their access is updated according to their remaining group membership, following the precedence rules.
+
+SCIM group membership will override manually assigned roles or roles assigned via Just-in-Time (JIT) provisioning. We recommend disabling JIT provisioning to avoid conflicts.
+
+
+### Group Naming Convention
+
+Group membership maps to LangSmith workspace membership and workspace roles with a specific naming convention:
+
+**Organization Admin Groups**
+
+Format: `Organization Admin` or `Organization Admins`
+
+Examples:
+
+* `LS:Organization Admins`
+* `Groups-Organization Admins`
+* `Organization Admin`
+
+** Workspace-Specific Groups**
+
+Format: `::`
+
+Examples:
+
+* `LS:Organization User:Production:Annotators`
+* `Groups-Organization User:Engineering:Developers`
+* `Organization User:Marketing:Viewers`
+
+### Email verification
+
+In cloud only, creating a new user with SCIM triggers an email to the user. They must verify their email address by clicking the link in this email. The link expires in 24 hours, and can be resent if needed by removing and re-adding the user via SCIM.
+
+### Prerequisites
+
+- Your organization must be on an Enterprise plan.
+- Your Identity Provider (IdP) must support SCIM 2.0.
+- Only [`Organization Admins`](/langsmith/observability-overview#organization-roles) can configure SCIM.
+- For cloud customers: [SAML SSO](/langsmith/user-management) must be configured for your organization.
+- For self-hosted customers: [OAuth with Client Secret](/langsmith/self-host-sso#with-secret) authentication mode must be enabled.
+
+
+Note the following:
+
+- Support for Okta is not yet released. If you are interested in using Okta with SCIM, please let us know at [support@langchain.dev](mailto:support@langchain.dev).
+- Other identity providers have not been tested but may function depending on their SCIM implementation.
+
+
+### Step 1: Configure SAML SSO (Cloud only)
+
+If you're using LangSmith Cloud, ensure [SAML SSO](/langsmith/user-management) is configured for your organization.
+
+LangSmith uses the SAML NameID to identify users. The NameID is a required field in the SAML response and is case-insensitive.
+
+The NameID must:
+
+1. Be unique to each user.
+2. Be a persistent value that never changes, such as a randomly generated unique user ID.
+3. Match exactly on each sign-in attempt. It should not rely on user input.
+
+The NameID should not be an email address or username because email addresses and usernames are more likely to change over time and can be case-sensitive.
+
+The NameID format must be `Persistent`, unless you are using a field, like email, that requires a different format.
+
+### Step 2: Disable JIT provisioning (Cloud only)
+
+Before enabling SCIM, disable [Just-in-Time (JIT) provisioning](/langsmith/user-management#just-in-time-jit-provisioning) to prevent conflicts between automatic and manual user provisioning. Use the `PATCH /orgs/current/info` [endpoint](https://api.smith.langchain.com/redoc#tag/orgs/operation/update_current_organization_info_api_v1_orgs_current_info_patch):
+
+```bash
+curl -X PATCH $LANGCHAIN_ENDPOINT/orgs/current/info \
+ -H "X-Api-Key: $LANGCHAIN_API_KEY" \
+ -H "Content-Type: application/json" \
+ -d '{"jit_provisioning_enabled": false}'
+```
+
+### Step 3: Generate SCIM bearer token
+
+Generate a SCIM Bearer Token for your organization. This token will be used by your IdP to authenticate SCIM API requests. Ensure env vars are set appropriately, for example:
+
+```bash
+curl -X POST $LANGCHAIN_ENDPOINT/v1/platform/orgs/current/scim/tokens \
+ -H "X-Api-Key: $LANGCHAIN_API_KEY" \
+ -H "X-Organization-Id: $LANGCHAIN_ORGANIZATION_ID" \
+ -H "Content-Type: application/json" \
+ -d '{"description": "Your description here"}'
+```
+
+Note that the SCIM Bearer Token value is not available outside of the response to this request. These additional endpoints are present:
+
+- `GET /v1/platform/orgs/current/scim/tokens`
+- `GET /v1/platform/orgs/current/scim/tokens/{scim_token_id}`
+- `PATCH /v1/platform/orgs/current/scim/tokens/{scim_token_id}` (only the `description` field is supported)
+- `DELETE /v1/platform/orgs/current/scim/tokens/{scim_token_id}`
+
+### Step 4: Configure your Identity Provider
+
+Follow the IdP-specific instructions to configure SCIM integration.
+
+#### Azure Entra ID
+
+For additional information, see Microsoft's [documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning).
+
+**Step 1: Configure SCIM in your Enterprise Application**
+
+1. Log in to the [Azure portal](https://portal.azure.com/#home) with a privileged role (e.g., `Global Administrator`).
+2. Navigate to your existing LangSmith Enterprise Application.
+3. In the left-side navigation, select **Manage** > **Provisioning**.
+4. Click **Get started**.
+
+**Step 2: Configure Admin credentials**
+
+1. Under **Admin Credentials**:
+
+ - **Tenant URL**:
+
+ - US: `https://api.smith.langchain.com/scim/v2`
+ - EU: `https://eu.api.smith.langchain.com/scim/v2`
+ - Self-hosted: `/scim/v2`
+
+ - **Secret Token**: Enter the SCIM Bearer Token generated in Step 3.
+
+2. Click **Test Connection** to verify the configuration.
+
+3. Click **Save**.
+
+**Step 3: Configure Attribute Mappings**
+
+Configure the following attribute mappings under `Mappings`:
+
+**User Attributes**
+
+Set **Target Object Actions** to `Create` and `Update` (start with `Delete` disabled for safety):
+
+| **LangSmith App Attribute** | **Microsoft Entra ID Attribute** | **Matching Precedence** |
+| :-----------------------------: | :----------------------------------------------------: | :----------------------: |
+| `userName` | `userPrincipalName` | |
+| `active` | `Not([IsSoftDeleted])` | |
+| `emails[type eq "work"].value` | `mail`1 | |
+| `name.formatted` | `displayName` OR `Join(" ", [givenName], [surname])`2 | |
+| `externalId` | `objectId`3 | 1 |
+
+1. User's email address must be present in Entra ID.
+2. Use the `Join` expression if your `displayName` does not match the format of `Firstname Lastname`.
+3. To avoid inconsistency, this should match the SAML NameID assertion and the `sub` OAuth2.0 claim. For SAML SSO in cloud, the `Unique User Identifier (Name ID)` required claim should be `user.objectID` and the `Name identifier format` should be `persistent`.
+
+**Group Attributes**
+
+Set **Target Object Actions** to `Create` and `Update` only (start with `Delete` disabled for safety):
+
+| **LangSmith App Attribute** | **Microsoft Entra ID Attribute** | **Matching Precedence** |
+| :-------------------------: | :-------------------------------: | :----------------------: |
+| `displayName` | `displayname`1 | 1 |
+| `externalId` | `objectId` | |
+| `members` | `members` | |
+
+1. Groups must follow the naming convention described in the [Azure Group Naming Convention](#group-naming-convention) section.
+
+**Step 4: Assign Users and Groups**
+
+1. Under **Applications** > **Applications**, select your LangSmith Enterprise Application.
+2. Under the **Assignments** tab, click **Assign** then either **Assign to People** or **Assign to Groups**.
+3. Make the desired selection(s), then **Assign** and **Done**.
+
+**Step 5: Enable Provisioning**
+
+1. Set **Provisioning Status** to `On` under **Provisioning**.
+2. Monitor the initial sync to ensure users and groups are provisioned correctly.
+3. Once verified, enable `Delete` actions for both User and Group mappings.
+
+For troubleshooting, refer to the [SAML SSO FAQs](/langsmith/faq#saml-sso-faqs). If you have issues setting up SCIM, reach out to the LangChain support team at [support@langchain.dev](mailto:support@langchain.dev).
\ No newline at end of file