Updated
Answer
Is there a free whiteboard with SSO and SCIM?
Yes. Freero is a free, open-source (MIT) online whiteboard that includes SAML or OpenID Connect single sign-on, SCIM provisioning and an audit log in every team workspace, with no paid plan and no seat count. It is also built for AI agents: Claude, ChatGPT and other assistants connect over MCP and propose changes that people accept.
The facts
- Can: Single sign-on per team workspace: verify your domain with a DNS TXT record, then connect a SAML 2.0 or OpenID Connect identity provider.
- Can: Owners can enforce SSO for the domain; that also refuses API tokens and apps made without it. A break-glass owner keeps a password sign-in in case the identity provider breaks.
- Can: SCIM 2.0 with a token per workspace: directories such as Okta and Microsoft Entra add people, map groups to roles or projects and deactivate leavers, which closes the workspace’s boards to them at once.
- Can: An append-only, hash-chained audit log per workspace, exportable as CSV or JSON and streamed to Splunk, Microsoft Sentinel, an HTTPS collector or syslog. Every API and MCP call by an agent is in it.
- Can: No plan unlocks any of this: the hosted service and every self-hosted server include it, and there is no licence fee.
More, each with where to check it: Freero key facts.
Single sign-on, SCIM and audit log, compared
Where each whiteboard puts these features. “Paid plans” means they exist, on a paid tier or add-on.
| Product | Single sign-on | SCIM provisioning | Audit log |
|---|---|---|---|
| Mirochecked | Paid plans · Business and up [1] | Paid plans · Enterprise [1] | Paid plans · Enterprise [1] |
| Muralchecked | Paid plans · Business and up [2] | Paid plans · Enterprise [2] | Paid plans · Enterprise [2] |
| FigJamchecked | Paid plans · Organization and Enterprise [3] | Paid plans · Organization and Enterprise [3] | Paid plans · activity logs on Organization and Enterprise [3] |
| Confluence whiteboardschecked | Paid plans · with Atlassian Guard Standard, listed at $4.35 per user a month [4] | Paid plans · with Atlassian Guard Standard, listed at $4.35 per user a month [4] | Paid plans · with Atlassian Guard Standard, listed at $4.35 per user a month [4] |
| Microsoft Whiteboardchecked | Yes · Microsoft Entra ID, with Conditional Access [5] | Not compared | Yes · board file activity in Microsoft Purview [6] |
| Excalidraw and Excalidraw+checked | No · SSO is on the roadmap backlog; SCIM isn’t listed [7] | No · SSO is on the roadmap backlog; SCIM isn’t listed [7] | Not compared |
| Freero | Yes · SAML 2.0 or OpenID Connect per workspace, free [docs] | Yes · SCIM 2.0, groups mapped to roles or projects [docs] | Yes · per workspace, hash-chained, exportable and streamed to your SIEM [docs] |
Sources and dates
- Miro: Pricing, checked (in Freero vs Miro)
- Mural: Pricing, checked (in Freero vs Mural)
- Figma Help Center: Figma plans and features, checked (in Freero vs FigJam)
- Atlassian: Guard pricing, checked (in Freero vs Confluence whiteboards)
- Microsoft Learn: Manage access to Whiteboard for your organization, checked (in Freero vs Microsoft Whiteboard)
- Microsoft Learn: Manage data for Whiteboard, checked (in Freero vs Microsoft Whiteboard)
- Excalidraw+: Roadmap, checked (in Freero vs Excalidraw)
How to set up SSO and SCIM in Freero
An owner or admin of a team workspace does this in its admin console; on a self-hosted server the operator only needs PUBLIC_URL set.
Create a team workspace
Sign up free and create a team workspace from your boards page. Its owners and admins get an admin console.Verify your domain
In your team’s admin console → Single sign-on, verify your domain with the TXT record shown.Connect your identity provider
Paste your identity provider’s metadata, test a sign-in, then enforce SSO if you want. OpenID Connect takes an issuer, a client id and a secret instead of metadata.Turn on provisioning
In your team’s admin console → Provisioning, create a SCIM token (shown once). Give your directory the SCIM URL and the token, then map its groups to roles or projects.
Keep reading
On this site
Frequently asked questions
Is single sign-on really free in Freero?
Yes. Freero has no paid plans, so SAML and OpenID Connect single sign-on, SCIM provisioning, the audit log and the admin console are part of every team workspace, on the hosted service and on every self-hosted server. There is no add-on to buy and no seat count.
Which identity providers work with Freero?
Any identity provider that speaks SAML 2.0 or OpenID Connect can sign people in at your verified domain. For provisioning, Freero serves SCIM 2.0, which directories such as Okta and Microsoft Entra use to add people, map groups and deactivate leavers.
Can I require SSO for everyone at my company?
Yes. Once your domain is verified, an owner can enforce SSO: sign-ins at that domain go to your identity provider, and API tokens and apps created without SSO are refused. The owner chosen as break-glass account keeps a password sign-in in case the identity provider breaks.
Do AI agents get around SSO?
No. An agent connected over MCP acts for one person, with that person’s access and only the permissions granted to the connection. When SSO is enforced, tokens and apps made without it are refused, a workspace can block apps entirely, and every agent call is in the audit log.
Bring your team and your agents to one board
Free to use, open source, and yours to host. No credit card, no seat count.