Pinecone Release Notes

Manage roles from your identity provider with SAML and SCIM

Organizations on the Enterprise plan with SSO can now manage Pinecone roles directly from their identity provider (IdP), instead of assigning them manually in Pinecone. Two modes are available:

• SAML role management sets each user's organization and project roles from a SAML attribute on every SSO login.
• SCIM provisioning syncs members and their roles in real time as you add, update, deactivate, or remove them in your IdP.

Both modes use the same pinecone:* role values and work with Okta and other SAML 2.0 / SCIM 2.0 providers. Configure them under Settings > Access > Identity provider in the Pinecone console. For more information, see Manage roles with Okta and SCIM provisioning with Okta.

Expanded role-based access controls (RBAC)

Pinecone now offers an expanded set of roles for managing access to organizations and projects. New Organization member and Project member roles grant more restricted access than the owner and manager roles, and projects now support granular editor and viewer roles (project, control plane, and data plane) that you can assign to users, service accounts, and API keys.

To better communicate the access hierarchy, organization owners are now shown in each project's member list. This replaces the separate project-role assignments that could fall out of sync with the access organization owners inherit to all projects. Effective permissions are unchanged.

If you used the previous role model, the User role has been renamed to Manager: the organization-level User role is now Organization manager, and the project-level User role is now Project manager. This is a name change only—permissions are unchanged and existing assignments are migrated automatically.

You can assign and manage roles in the Pinecone console or programmatically with the Admin API. For more information, see Manage roles and access, Organization roles, and Project roles.