@@ -137,7 +137,7 @@ Mapping a permission group to a directory group switches that permission group t
 
 </Steps>
 
-<Image src="/static/enterprise/scim-provisioning.png" alt="Provisioning tab with an active SCIM connection, tokens, provisioning rules, group mappings, and recent activity" width={832} height={1314} />
+<Image src="/static/enterprise/scim-provisioning.png" alt="Provisioning tab with an active SCIM connection, tokens, provisioning rules, group mappings, and recent activity" width={832} height={1284} />
 
 ## How access is withdrawn
 
@@ -149,7 +149,7 @@ With locking off, access held before the directory mapping is preserved. If some
 
 ## Provisioning and SSO together
 
-A member the directory created can sign in with SSO immediately; the two resolve to the same account through your verified domain.
+An active provisioned member can sign in once SSO is configured for their verified domain. Provisioning and SSO resolve to the same account.
 
 To stop SSO from creating organization memberships, open **Provisioning rules → Manage rules** and enable **Disable just-in-time provisioning**. While the SCIM connection is active and entitled, this overrides **Sign-in → First sign-in → Automatic**. Existing organization members can still sign in, including members added by invitation; the setting does not require every existing member to have been provisioned by SCIM.
 
 
@@ -79,7 +79,7 @@ Use **Domains** to verify ownership, then return to **Sign-in** to configure you
 
 ### 4. Copy the callback URL
 
-Copy **Callback URL** for OIDC or **ACS URL (Reply URL)** for SAML. This is the endpoint that receives your identity provider's authentication response. Register it in your IdP before saving.
+Copy **Callback URL** for OIDC or **ACS URL (Reply URL)** for SAML. This is the endpoint that receives your identity provider's authentication response. Register it in your IdP before saving. If you set a SAML **Callback URL override** under Advanced options, the copyable ACS URL uses that override.
 
 **OIDC providers** (Okta, Microsoft Entra ID, Google Workspace, Auth0):
 ```
 
@@ -19,7 +19,7 @@ Verified Domains let organization owners and admins on Enterprise plans prove th
 
 Go to **Settings → Organization → Single sign-on → Domains**. The **Verified domains** section is shared by sign-in and directory provisioning.
 
-<Image src="/static/enterprise/sso-domains.png" loading="eager" alt="Domains tab showing a verified domain and the DNS record for a pending domain" width={832} height={659} />
+<Image src="/static/enterprise/sso-domains.png" loading="eager" alt="Domains tab showing a verified domain and the DNS record for a pending domain" width={832} height={663} />
 
 1. Enter the domain, for example `acme.com`, and click **Add domain**.
 2. Sim shows a DNS **TXT record** to publish — a host (`_sim-challenge.acme.com`) and a unique value (`sim-domain-verification=…`).
 
@@ -22,19 +22,18 @@ export const SETTING_TOGGLES = [
     key: 'lockManualMembership',
     label: 'Lock managed membership',
     description:
-      'Refuse invitations, role changes, and manual grants for members the directory provisions. The next sync would revert them anyway.',
+      'Prevent manual invitations, role changes, and access grants for provisioned members.',
   },
   {
     key: 'disableJit',
     label: 'Disable just-in-time provisioning',
     description:
-      'Prevent SSO from creating new organization memberships. Existing members can still sign in, including members added by invitation.',
+      'Prevent SSO from adding new organization members. Existing members can still sign in.',
   },
   {
     key: 'autoMapPermissionGroupsByName',
     label: 'Match permission groups by name',
-    description:
-      'When a pushed group has the same name as one of your permission groups, map them automatically. Nothing is created.',
+    description: 'Map directory groups to existing permission groups with the same name.',
   },
 ] as const
 
 
@@ -14,6 +14,7 @@ import {
   ChipTag,
   Expandable,
   ExpandableContent,
+  Label,
   Switch,
   toast,
 } from '@sim/emcn'
@@ -32,7 +33,10 @@ import {
   SettingsEmptyState,
   SettingsQueryErrorState,
 } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
-import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
+import {
+  RESOURCE_LIST_STACK,
+  SettingsResourceRow,
+} from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
 import {
   useOrganizationWorkspaces,
@@ -107,8 +111,7 @@ function CredentialRow({ credential, onRevoke }: CredentialRowProps) {
     : 'no expiry'
   return (
     <SettingsResourceRow
-      icon={<Key />}
-      title={<span className='font-mono'>{credential.tokenPrefix}…</span>}
+      title={`${credential.tokenPrefix}…`}
       description={`Last used ${formatRelative(credential.lastUsedAt)} · ${expiry}`}
       trailing={
         <RowActionsMenu
@@ -268,7 +271,7 @@ function GroupMappings({ organizationId, active }: GroupMappingsProps) {
             title={group.displayName}
             description={`${group.memberCount} member${group.memberCount === 1 ? '' : 's'}`}
           />
-          <div className='flex flex-col gap-3 pl-[46px]'>
+          <div className='flex flex-col gap-3'>
             {group.mappings.length > 0 && (
               <div className='flex flex-wrap gap-1.5'>
                 {group.mappings.map((mapping) => (
@@ -341,7 +344,7 @@ function ActivityList({ organizationId, active }: ActivityListProps) {
               <ChipTag variant={failed ? 'gray' : 'mono'} invalid={failed}>
                 {entry.status}
               </ChipTag>
-              <span className='truncate font-mono text-[var(--text-primary)]'>
+              <span className='truncate text-[var(--text-body)]'>
                 {entry.method} {entry.path}
               </span>
               <span className='ml-auto shrink-0 text-[var(--text-muted)]'>
@@ -439,7 +442,6 @@ function ConnectionDetails({ organizationId, connection, active }: ConnectionDet
               id='scim-base-url'
               value={connection.baseUrl}
               copyLabel='Copy base URL'
-              inputClassName='font-mono'
             />
           </SettingRow>
 
@@ -463,13 +465,15 @@ function ConnectionDetails({ organizationId, connection, active }: ConnectionDet
             {connection.credentials.length === 0 ? (
               <SettingsEmptyState variant='inline'>No tokens yet.</SettingsEmptyState>
             ) : (
-              connection.credentials.map((credential) => (
-                <CredentialRow
-                  key={credential.id}
-                  credential={credential}
-                  onRevoke={(credential) => setPendingRevokeId(credential.id)}
-                />
-              ))
+              <div className={RESOURCE_LIST_STACK}>
+                {connection.credentials.map((credential) => (
+                  <CredentialRow
+                    key={credential.id}
+                    credential={credential}
+                    onRevoke={(credential) => setPendingRevokeId(credential.id)}
+                  />
+                ))}
+              </div>
             )}
             <div className='flex flex-wrap items-center gap-2'>
               <ChipSelect
@@ -510,19 +514,18 @@ function ConnectionDetails({ organizationId, connection, active }: ConnectionDet
           <ExpandableContent id='scim-rules'>
             <div className='flex flex-col gap-4.5 pt-4'>
               {SETTING_TOGGLES.map((toggle) => (
-                <SettingRow
-                  key={toggle.key}
-                  label={toggle.label}
-                  description={toggle.description}
-                  htmlFor={`scim-${toggle.key}`}
-                >
+                <div key={toggle.key} className='flex items-center justify-between gap-4'>
+                  <div className='flex flex-col gap-1'>
+                    <Label htmlFor={`scim-${toggle.key}`}>{toggle.label}</Label>
+                    <p className='text-[var(--text-muted)] text-caption'>{toggle.description}</p>
+                  </div>
                   <Switch
                     id={`scim-${toggle.key}`}
                     checked={connection.settings[toggle.key] ?? false}
                     onCheckedChange={(checked) => void handleToggleSetting(toggle.key, checked)}
                     disabled={configure.isPending}
                   />
-                </SettingRow>
+                </div>
               ))}
             </div>
           </ExpandableContent>
@@ -563,17 +566,12 @@ function ConnectionDetails({ organizationId, connection, active }: ConnectionDet
         </ChipModalHeader>
         <ChipModalBody>
           <ChipModalField
-            type='custom'
+            type='copy'
             title='Token'
+            value={issuedSecret ?? ''}
+            copyLabel='Copy token'
             hint='Copy it into your identity provider now. Sim stores only a digest and cannot show it again.'
-          >
-            <ChipCopyInput
-              aria-label='Token'
-              value={issuedSecret ?? ''}
-              copyLabel='Copy token'
-              inputClassName='font-mono'
-            />
-          </ChipModalField>
+          />
         </ChipModalBody>
         <ChipModalFooter
           onCancel={() => setIssuedSecret(null)}
@@ -646,18 +644,20 @@ export function ScimSection({ organizationId, onOpenDomains, active }: ScimSecti
     <div className='flex flex-col gap-7'>
       <SettingsSection label='Directory provisioning'>
         <div className='flex flex-col gap-4.5'>
-          <SettingRow
-            label='Enable directory provisioning'
-            description='Create, update, and deactivate members from your identity provider with SCIM 2.0.'
-            htmlFor='scim-enabled'
-          >
+          <div className='flex items-center justify-between gap-4'>
+            <div className='flex flex-col gap-1'>
+              <Label htmlFor='scim-enabled'>Enable directory provisioning</Label>
+              <p className='text-[var(--text-muted)] text-caption'>
+                Create, update, and deactivate members from your identity provider with SCIM 2.0.
+              </p>
+            </div>
             <Switch
               id='scim-enabled'
               checked={enabled}
               onCheckedChange={(checked) => void handleToggleEnabled(checked)}
               disabled={isLoading || configure.isPending}
             />
-          </SettingRow>
+          </div>
 
           {!enabled && (
             <div className='flex flex-wrap items-center justify-between gap-2'>
 
@@ -169,6 +169,71 @@ describe('attribute projection', () => {
     expect(scimUserResourceSchema.safeParse(projected).success).toBe(true)
   })
 
+  it.each([
+    'userName.foo',
+    'active.foo',
+    'name.givenName.foo',
+    'emails.value.foo',
+    'groups.value.foo',
+    'urn:ietf:params:scim:schemas:core:2.0:User:USERNAME.foo',
+    'urn:okta:sim:2.0:user:custom:costCenter.foo',
+    'urn:okta:sim:2.0:user:custom:tags.foo',
+  ])('does not return scalar values for a nonexistent descendant %s', (attributes) => {
+    const base = userRow()
+    const resource = toUserResource(
+      {
+        ...base,
+        attributes: {
+          ...base.attributes,
+          extra: { 'urn:okta:sim:2.0:user:custom': { costCenter: 'R&D', tags: ['staff'] } },
+        },
+      },
+      BASE_URL
+    )
+    const projected = projectResource(resource, parseAttributeProjection({ attributes }))
+    expect(Object.keys(projected).sort()).toEqual(['id', 'meta', 'schemas'])
+    expect(scimUserResourceSchema.safeParse(projected).success).toBe(true)
+  })
+
+  it('omits arrays with no matching sub-attributes while retaining valid selections', () => {
+    const projected = projectResource(
+      toUserResource(userRow(), BASE_URL),
+      parseAttributeProjection({ attributes: 'emails.unknown,name.givenName.foo,name.familyName' })
+    )
+    expect(projected).not.toHaveProperty('emails')
+    expect(projected.name).toEqual({ familyName: 'Lovelace' })
+  })
+
+  it('keeps explicitly selected parents even when nonexistent descendants are also requested', () => {
+    const resource = toUserResource(userRow(), BASE_URL)
+    const projected = projectResource(
+      resource,
+      parseAttributeProjection({
+        attributes: 'userName,userName.foo,name,name.givenName.foo,emails,emails.value.foo',
+      })
+    )
+    expect(projected.userName).toBe(resource.userName)
+    expect(projected.name).toEqual(resource.name)
+    expect(projected.emails).toEqual(resource.emails)
+  })
+
+  it('ignores exclusions of nonexistent scalar descendants', () => {
+    const resource = toUserResource(userRow(), BASE_URL)
+    const projected = projectResource(
+      resource,
+      parseAttributeProjection({
+        excludedAttributes: 'userName.foo,name.givenName.foo,emails.value.foo',
+      })
+    )
+    expect(projected).toEqual(resource)
+  })
+
+  it('keeps an explicitly selected empty multi-valued attribute', () => {
+    const resource = toUserResource({ ...userRow(), groups: [] }, BASE_URL)
+    const projected = projectResource(resource, parseAttributeProjection({ attributes: 'groups' }))
+    expect(projected.groups).toEqual([])
+  })
+
   it('projects each multi-valued entry and still loads requested group sub-attributes', () => {
     const projection = parseAttributeProjection({ attributes: 'emails.value,groups.value' })
     const projected = projectResource(toUserResource(userRow(), BASE_URL), projection)
 
@@ -286,11 +286,12 @@ function projectAttribute(
     return undefined
   }
   if (Array.isArray(value)) {
-    return value
+    const projected = value
       .map((entry) => projectAttribute(entry, path, projection, included))
       .filter((entry) => entry !== undefined)
+    return included || projected.length > 0 ? projected : undefined
   }
-  if (!isRecord(value)) return value
+  if (!isRecord(value)) return included ? value : undefined
   const projected: Record<string, unknown> = {}
   for (const [key, nested] of Object.entries(value)) {
     const selected = projectAttribute(