Who this is for
Group CIO or head of hotel systems, group revenue office, corporate information-security lead, and the Suite Profit onboarding architect assigned to the portfolio. Property-level GMs and revenue managers are consumers of this configuration, not authors of it.
Prerequisites
- Corporate identity provider live and administered by the group: Okta, Microsoft Entra ID (Azure AD) or Ping, with SCIM 2.0 enabled.
- Named Profitroom account manager for the group, with authority to raise API applications on every property in the roster.
- Group-approved secrets vault: HashiCorp Vault, 1Password Teams, AWS Secrets Manager or Azure Key Vault.
- Signed data-processing agreement between the operating entity of the group and Suite Profit Sp. z o.o.
Step 1 — Federate the operator console with the group IdP
The Suite Profit onboarding architect provisions a SAML application in the group IdP under the display name Suite Profit — Operator Console. Operator roles map from IdP security groups: SuiteProfit-Group-Revenue, SuiteProfit-Group-Ops, SuiteProfit-Portfolio-IT, SuiteProfit-Property-GM. The console never stores a password locally. Removing an operator from a security group revokes their access on the next SCIM push.
Step 2 — Provision the Suite Profit service account
Alongside human operators, we provision a non-human service account from the corporate directory: svc-suiteprofit-[group-slug]. This account is scoped to read the property roster from the IdP and does not carry any Profitroom API access itself. It is the bridge used by the operator console to resolve who is authorised to see which property.
Step 3 — Request a Profitroom API application per property
The group's Profitroom account manager raises one API application per property, following the Suite Profit enterprise naming convention suiteprofit.[group-slug].[property-slug].[env]. Scopes are the minimum set the modules on that property require — the account manager receives the scope map from the Suite Profit onboarding architect during scoping week and does not need to guess.
Step 4 — Paste the key into the Suite Profit operator console
The API key comes back from Profitroom exactly once. It is loaded through a vault broker rather than through a workstation clipboard: the corporate systems engineer opens the console, selects the target property, clicks Bind Profitroom application, and the vault broker injects the key over an authenticated short-lived session. The console records a masked fingerprint and a rotation date; the plaintext key never touches the operator's device.
Step 5 — Handshake protocol and per-property validation
The Suite Profit dashboard runs the enterprise handshake sequence on each property in turn. First, the module verifies the Profitroom Establishment ID matches the property record in the portfolio. Second, it exercises each required scope with a read-only probe. Third, it writes a canary tag on a sandbox reservation and reads it back. Fourth, it registers the property with the Multi-Property Command Centre so group-level policies inherit correctly.
Step 6 — Post-connection review
Once every property in the portfolio is green, the onboarding architect runs a one-hour post-connection review with the group revenue office, walks through the audit trail per property, and hands off to the Suite Profit dedicated onboarding team for the module rollout schedule.
Common enterprise issues
- SCIM push disabled by the IdP owner — role changes stop propagating within minutes and start propagating on the next full sync. Confirm the SCIM schedule with the IdP admin.
- Group-level Profitroom account has read-only entitlements — the account manager must be uplifted to Portfolio Administrator before API applications can be raised. Do this before the connection week starts.
- Property Establishment ID mismatch — the group's internal property register drifted from Profitroom's roster. The Suite Profit architect resolves this before proceeding.
Estimated timeline
For a portfolio of three to fifteen properties, initial connection under corporate SSO takes two to three weeks: one week of IdP and vault scoping, four to eight business days of per-property Profitroom API application issuance and binding, and a two-day validation and review window with the group revenue office before the modules are enabled.