diff --git a/USAGE.md b/USAGE.md
index d6c1af6f..31f38bb1 100644
--- a/USAGE.md
+++ b/USAGE.md
@@ -722,9 +722,11 @@ tw roles permissions -o my-org
 tw roles add -o my-org -n launcher -d "Launch only" -p <permission>,<permission>
 ```
 
-### Teams and quotas
+### Teams, IdP groups and SCIM
 
-- `tw teams view|update|workspaces`: view a team, update its name or description, and list its workspaces.
+- `tw teams view|update|workspaces`: view a team, update its name, description or linked IdP group (`--idp-group`, `--unlink-idp-group`), and list its workspaces.
+- `tw organizations idp-groups list|add|delete`: manage the identity provider groups available to the organization.
+- `tw organizations scim view|create-token|rotate-token|revoke-token`: manage SCIM provisioning.
 - `tw organizations quotas` and `tw members roles -u <user>`: view organization quotas and a member's workspace roles.
 
 ## Personal access
@@ -754,10 +756,19 @@ tw managed-identities add -o my-org -n hpc1 -p slurm -H login.hpc.example.com
 tw managed-identities credentials -o my-org -n hpc1 add -l my_linux_user -k ~/.ssh/id_rsa
 ```
 
+## Audit logs
+
+Run `tw audit-logs -h` to view the supported operations: `list`, `view`, and `export`. These commands require a root user.
+
+```bash
+tw audit-logs export --after 2026-09-01T00:00:00Z --before 2026-09-30T23:59:59Z -o september.csv
+```
+
 ## Other additions
 
 - `tw compute-envs enable|disable`: enable or disable a compute environment.
 - `tw compute-envs add`:
+  - Intelligent Compute options on `aws-cloud`, `azure-cloud`, and `google-cloud`. Run `tw compute-envs add <platform> -h` for the options each platform supports.
   - AWS Batch: CloudWatch log group and DRAGEN options.
   - AWS Cloud: `--log-group`. Google Cloud: `--project-id`.
   - HPC platforms: `--propagate-head-job-options`.
diff --git a/conf/reflect-config.json b/conf/reflect-config.json
index d55fccd0..0bc736cb 100644
--- a/conf/reflect-config.json
+++ b/conf/reflect-config.json
@@ -166,6 +166,12 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.AuditLogsCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.CollaboratorsCmd",
   "allDeclaredFields":true,
@@ -403,6 +409,40 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.AuditLogsFilterOptions",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"after"}, {"name":"before"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.AuditLogsFilterOptions$DateTimeConverter",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.ExportCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"filter"}, {"name":"output"}, {"name":"state"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.ListCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"filter"}, {"name":"max"}, {"name":"pageToken"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.ViewCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"id"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.collaborators.AbstractCollaboratorsCmd",
   "allDeclaredFields":true,
@@ -1664,6 +1704,12 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.organizations.IdpGroupsCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.organizations.ListCmd",
   "allDeclaredFields":true,
@@ -1695,6 +1741,12 @@
   "fields":[{"name":"organizationRefOptions"}],
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.organizations.ScimCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.organizations.UpdateCmd",
   "allDeclaredFields":true,
@@ -1707,6 +1759,62 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.AddCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"name"}, {"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.DeleteCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"group"}, {"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.DeleteCmd$GroupRef",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"id"}, {"name":"name"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.ListCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.CreateTokenCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.RevokeTokenCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.RotateTokenCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.ViewCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.participants.AbstractParticipantsCmd",
   "allDeclaredFields":true,
@@ -2326,6 +2434,13 @@
   "fields":[{"name":"description"}, {"name":"idpGroup"}, {"name":"newName"}, {"name":"organizationRef"}, {"name":"ref"}],
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.teams.UpdateCmd$IdpGroup",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"name"}, {"name":"unlink"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.teams.ViewCmd",
   "queryAllDeclaredMethods":true,
@@ -2531,6 +2646,24 @@
   "allDeclaredMethods":true,
   "allDeclaredConstructors":true
 },
+{
+  "name":"io.seqera.tower.cli.responses.auditlogs.AuditLogView",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.auditlogs.AuditLogsExported",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.auditlogs.AuditLogsList",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
 {
   "name":"io.seqera.tower.cli.responses.collaborators.CollaboratorsList",
   "allDeclaredFields":true,
@@ -2848,6 +2981,24 @@
   "allDeclaredMethods":true,
   "allDeclaredConstructors":true
 },
+{
+  "name":"io.seqera.tower.cli.responses.organizations.IdpGroupAdded",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.IdpGroupDeleted",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.IdpGroupsList",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
 {
   "name":"io.seqera.tower.cli.responses.organizations.OrganizationQuotasView",
   "allDeclaredFields":true,
@@ -2890,6 +3041,28 @@
   "queryAllDeclaredMethods":true,
   "queryAllDeclaredConstructors":true
 },
+{
+  "name":"io.seqera.tower.cli.responses.organizations.ScimConfigView",
+  "allDeclaredFields":true,
+  "allDeclaredMethods":true,
+  "allDeclaredConstructors":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.ScimTokenCreated",
+  "allDeclaredFields":true,
+  "allDeclaredMethods":true,
+  "allDeclaredConstructors":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.ScimTokenRevoked",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
 {
   "name":"io.seqera.tower.cli.responses.participants.ParticipantAdded",
   "allDeclaredFields":true,
diff --git a/src/main/java/io/seqera/tower/cli/Tower.java b/src/main/java/io/seqera/tower/cli/Tower.java
index 68c8c9e7..74a92294 100644
--- a/src/main/java/io/seqera/tower/cli/Tower.java
+++ b/src/main/java/io/seqera/tower/cli/Tower.java
@@ -23,6 +23,7 @@
 import io.seqera.tower.cli.commands.AbstractCmd;
 import io.seqera.tower.cli.commands.AccessTokensCmd;
 import io.seqera.tower.cli.commands.ActionsCmd;
+import io.seqera.tower.cli.commands.AuditLogsCmd;
 import io.seqera.tower.cli.commands.CollaboratorsCmd;
 import io.seqera.tower.cli.commands.ComputeEnvsCmd;
 import io.seqera.tower.cli.commands.CredentialsCmd;
@@ -62,6 +63,7 @@
         subcommands = {
                 AccessTokensCmd.class,
                 ActionsCmd.class,
+                AuditLogsCmd.class,
                 CollaboratorsCmd.class,
                 ComputeEnvsCmd.class,
                 CredentialsCmd.class,
diff --git a/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java b/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
index 628f90f0..cf52ab0e 100644
--- a/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
@@ -19,6 +19,7 @@
 import io.seqera.tower.ApiClient;
 import io.seqera.tower.ApiException;
 import io.seqera.tower.api.ActionsApi;
+import io.seqera.tower.api.AdminApi;
 import io.seqera.tower.api.AvatarsApi;
 import io.seqera.tower.api.ComputeEnvsApi;
 import io.seqera.tower.api.CredentialsApi;
@@ -63,6 +64,7 @@
 import io.seqera.tower.model.ComputeEnvResponseDto;
 import io.seqera.tower.model.Credentials;
 import io.seqera.tower.model.DataStudioQueryAttribute;
+import io.seqera.tower.model.IdpGroupEntry;
 import io.seqera.tower.model.ListComputeEnvsResponseEntry;
 import io.seqera.tower.model.ListPipelineVersionsResponse;
 import io.seqera.tower.model.ListWorkspacesAndOrgResponse;
@@ -206,6 +208,10 @@ protected ActionsApi actionsApi() throws ApiException {
         return actionsApi == null ? new ActionsApi(apiClient()) : actionsApi;
     }
 
+    protected AdminApi adminApi() throws ApiException {
+        return new AdminApi(apiClient());
+    }
+
     protected AvatarsApi avatarsApi() throws ApiException {
         return avatarsApi == null ? new AvatarsApi(apiClient()) : avatarsApi;
     }
@@ -548,6 +554,14 @@ protected OrgAndWorkspaceDto findOrganizationByRef(String organizationRef) throw
         return orgAndWorkspaceDbDtoList.stream().findFirst().orElseThrow(() -> new OrganizationNotFoundException(organizationRef));
     }
 
+    protected IdpGroupEntry findIdpGroupByName(Long orgId, String displayName) throws ApiException {
+        return orgsApi().listOrganizationIdpGroups(orgId).getGroups()
+                .stream()
+                .filter(group -> Objects.equals(group.getDisplayName(), displayName))
+                .findFirst()
+                .orElseThrow(() -> new TowerException(String.format("IdP group '%s' not found in organization '%d'", displayName, orgId)));
+    }
+
     protected List<Long> findOrCreateLabels(Long wspId, List<Label> labels) throws ApiException {
         if (labels != null && !labels.isEmpty()) {
             LabelsFinder finder = new LabelsFinder(labelsApi());
diff --git a/src/main/java/io/seqera/tower/cli/commands/AuditLogsCmd.java b/src/main/java/io/seqera/tower/cli/commands/AuditLogsCmd.java
new file mode 100644
index 00000000..9b281148
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/AuditLogsCmd.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands;
+
+import io.seqera.tower.cli.commands.auditlogs.ExportCmd;
+import io.seqera.tower.cli.commands.auditlogs.ListCmd;
+import io.seqera.tower.cli.commands.auditlogs.ViewCmd;
+import picocli.CommandLine.Command;
+
+@Command(
+        name = "audit-logs",
+        description = "Inspect the installation audit logs. Requires a root user (platform administrator).",
+        subcommands = {
+                ListCmd.class,
+                ViewCmd.class,
+                ExportCmd.class,
+        }
+)
+public class AuditLogsCmd extends AbstractRootCmd {
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java b/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java
index 543a1d04..5f814203 100644
--- a/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java
@@ -18,8 +18,10 @@
 
 import io.seqera.tower.cli.commands.organizations.AddCmd;
 import io.seqera.tower.cli.commands.organizations.DeleteCmd;
+import io.seqera.tower.cli.commands.organizations.IdpGroupsCmd;
 import io.seqera.tower.cli.commands.organizations.ListCmd;
 import io.seqera.tower.cli.commands.organizations.QuotasCmd;
+import io.seqera.tower.cli.commands.organizations.ScimCmd;
 import io.seqera.tower.cli.commands.organizations.UpdateCmd;
 import io.seqera.tower.cli.commands.organizations.ViewCmd;
 import picocli.CommandLine;
@@ -34,6 +36,8 @@
                 UpdateCmd.class,
                 ViewCmd.class,
                 QuotasCmd.class,
+                IdpGroupsCmd.class,
+                ScimCmd.class,
         }
 )
 public class OrganizationsCmd extends AbstractRootCmd {
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/AuditLogsFilterOptions.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/AuditLogsFilterOptions.java
new file mode 100644
index 00000000..12c8d8d4
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/AuditLogsFilterOptions.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import picocli.CommandLine.ITypeConverter;
+import picocli.CommandLine.Option;
+
+import java.time.OffsetDateTime;
+
+public class AuditLogsFilterOptions {
+
+    @Option(names = {"--after"}, description = "Show only logs on or after this ISO-8601 date-time, e.g. 2026-01-31T00:00:00Z", converter = DateTimeConverter.class)
+    public OffsetDateTime after;
+
+    @Option(names = {"--before"}, description = "Show only logs on or before this ISO-8601 date-time, e.g. 2026-01-31T23:59:59Z", converter = DateTimeConverter.class)
+    public OffsetDateTime before;
+
+    public static class DateTimeConverter implements ITypeConverter<OffsetDateTime> {
+        @Override
+        public OffsetDateTime convert(String value) {
+            return OffsetDateTime.parse(value);
+        }
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
new file mode 100644
index 00000000..96be58c7
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsExported;
+import io.seqera.tower.model.AuditLogV2QueryAttribute;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Mixin;
+import picocli.CommandLine.Option;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.util.List;
+
+@Command(
+        name = "export",
+        description = "Export audit logs as CSV. Fails when too many logs match: narrow the date range. Requires a root user."
+)
+public class ExportCmd extends AbstractApiCmd {
+
+    @Mixin
+    public AuditLogsFilterOptions filter;
+
+    @Option(names = {"--state"}, description = "Include the state of each target before and after the change. Requires the audit state images feature.")
+    public boolean state;
+
+    @Option(names = {"-o", "--output"}, description = "Output CSV file path. Prints the CSV to stdout when omitted.")
+    public Path output;
+
+    @Override
+    protected Response exec() throws ApiException, IOException {
+        // The SDK downloads into a temp file; it holds installation-wide audit data, so never leave it behind
+        Path csv = adminApi().exportAuditLogsV2Csv(state ? List.of(AuditLogV2QueryAttribute.state) : null, filter.after, filter.before).toPath();
+        try {
+            if (output == null) {
+                return new AuditLogsExported(null, Files.readString(csv));
+            }
+            Files.move(csv, output, StandardCopyOption.REPLACE_EXISTING);
+            return new AuditLogsExported(output.toString(), null);
+        } finally {
+            Files.deleteIfExists(csv);
+        }
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ListCmd.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ListCmd.java
new file mode 100644
index 00000000..12fd4b92
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ListCmd.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsList;
+import io.seqera.tower.model.ListAuditLogV2Response;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Mixin;
+import picocli.CommandLine.Option;
+
+
+@Command(
+        name = "list",
+        description = "List audit logs, newest first. Requires a root user."
+)
+public class ListCmd extends AbstractApiCmd {
+
+    @Mixin
+    public AuditLogsFilterOptions filter;
+
+    @Option(names = {"--max"}, description = "Maximum number of logs per page")
+    public Integer max;
+
+    @Option(names = {"--page-token"}, description = "Token of the page to show, as printed by a previous list with the same filters")
+    public String pageToken;
+
+    @Override
+    protected Response exec() throws ApiException {
+        ListAuditLogV2Response response = adminApi().listAuditLogsV2(null, pageToken, max, filter.after, filter.before);
+        return new AuditLogsList(response.getAuditLogs(), response.getNextPageToken());
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ViewCmd.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ViewCmd.java
new file mode 100644
index 00000000..f2b87372
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ViewCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogView;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "view",
+        description = "View an audit log. Requires a root user."
+)
+public class ViewCmd extends AbstractApiCmd {
+
+    @Option(names = {"-i", "--id"}, description = "Audit log identifier", required = true)
+    public Long id;
+
+    @Override
+    protected Response exec() throws ApiException {
+        return new AuditLogView(adminApi().describeAuditLogV2(id, null));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java
index a67a8ae3..1e937a3e 100644
--- a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java
+++ b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java
@@ -21,6 +21,7 @@
 import io.seqera.tower.model.AwsCloudConfig;
 import io.seqera.tower.model.ComputeEnvComputeConfig.PlatformEnum;
 import io.seqera.tower.model.SchedConfig;
+import io.seqera.tower.model.SchedConfigPool;
 import picocli.CommandLine.ArgGroup;
 import picocli.CommandLine.Option;
 
@@ -70,13 +71,13 @@ public AwsCloudConfig computeConfig() throws ApiException, IOException {
                 .allowBuckets(allowBuckets);
 
         if (sched != null) {
-            SchedConfig schedConfig = new SchedConfig();
-            if (sched.provisioningModel != null) {
-                schedConfig.provisioningModel(sched.provisioningModel);
-            }
-            if (sched.machineTypes != null) {
-                schedConfig.machineTypes(sched.machineTypes);
-            }
+            SchedConfig schedConfig = new SchedConfig()
+                    .provisioningModel(sched.provisioningModel)
+                    .machineTypes(sched.machineTypes)
+                    .predictionModel(sched.predictionModel)
+                    .nvmeEnabled(sched.nvmeEnabled)
+                    .backendStrategy(sched.backendStrategy)
+                    .pool(sched.warmPool());
             config.schedConfig(schedConfig);
         }
 
@@ -126,6 +127,37 @@ public static class SchedOptions {
 
         @Option(names = {"--sched-machine-types"}, description = "EC2 instance types for compute nodes managed by the Seqera scheduler. Comma-separated list (e.g., m5.xlarge,c5.2xlarge). Leave empty to let the scheduler select the most cost-effective types.", split = ",")
         public List<String> machineTypes;
+
+        @Option(names = {"--prediction-model"}, description = "Model the Seqera scheduler uses to predict task resource requirements. Suggested values: none, qr/v1, qr/v2, qr/v3. If absent, the scheduler default (none) applies.")
+        public String predictionModel;
+
+        @Option(names = {"--nvme-storage"}, description = "Restrict the Seqera scheduler to EC2 instance types that provide local SSD (NVMe) storage for faster I/O.")
+        public Boolean nvmeEnabled;
+
+        @Option(names = {"--backend-strategy"}, description = "Backend the Seqera scheduler uses to run tasks. ECS delegates task execution to AWS ECS; EC2 runs tasks directly on EC2 instances. Valid values: ECS, EC2.")
+        public SchedConfig.BackendStrategyEnum backendStrategy;
+
+        @Option(names = {"--warm-pool"}, description = "Keep a pool of idle VMs ready to absorb incoming tasks with minimal start latency. Requires --warm-pool-size. Only applies with --backend-strategy EC2.")
+        public Boolean warmPoolEnabled;
+
+        @Option(names = {"--warm-pool-size"}, description = "Number of idle VMs to keep in the warm pool. Must be greater than zero.")
+        public Integer warmPoolSize;
+
+        @Option(names = {"--warm-pool-scale-to-zero"}, paramLabel = "<seconds>", description = "Seconds of inactivity after which the warm pool scales to zero. Set to 0 to never scale to zero.")
+        public Integer warmPoolScaleToZeroSecs;
+
+        SchedConfigPool warmPool() {
+            if (warmPoolEnabled == null && warmPoolSize == null && warmPoolScaleToZeroSecs == null) {
+                return null;
+            }
+            if (Boolean.TRUE.equals(warmPoolEnabled) && (warmPoolSize == null || warmPoolSize < 1)) {
+                throw new TowerRuntimeException("Option --warm-pool requires --warm-pool-size greater than zero.");
+            }
+            return new SchedConfigPool()
+                    .enabled(warmPoolEnabled)
+                    .desiredWarm(warmPoolSize)
+                    .scaleToZeroSecs(warmPoolScaleToZeroSecs);
+        }
     }
 
     public static class AdvancedOptions {
diff --git a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java
index 75bdd801..dd4f600a 100644
--- a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java
+++ b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java
@@ -69,13 +69,11 @@ public AzCloudConfig computeConfig() throws ApiException, IOException {
                 .resourceGroup(resourceGroup);
 
         if (sched != null) {
-            SchedConfig schedConfig = new SchedConfig();
-            if (sched.provisioningModel != null) {
-                schedConfig.provisioningModel(sched.provisioningModel);
-            }
-            if (sched.machineTypes != null) {
-                schedConfig.machineTypes(sched.machineTypes);
-            }
+            SchedConfig schedConfig = new SchedConfig()
+                    .provisioningModel(sched.provisioningModel)
+                    .machineTypes(sched.machineTypes)
+                    .predictionModel(sched.predictionModel)
+                    .nvmeEnabled(sched.nvmeEnabled);
             config.schedConfig(schedConfig);
         }
 
@@ -113,6 +111,12 @@ public static class SchedOptions {
 
         @Option(names = {"--sched-machine-types"}, description = "Azure VM sizes for compute nodes managed by the Seqera scheduler. Comma-separated list (e.g., Standard_D4s_v3,Standard_E4s_v3). Leave empty to let the scheduler select the most cost-effective sizes.", split = ",")
         public List<String> machineTypes;
+
+        @Option(names = {"--prediction-model"}, description = "Model the Seqera scheduler uses to predict task resource requirements. Suggested values: none, qr/v1, qr/v2, qr/v3. If absent, the scheduler default (none) applies.")
+        public String predictionModel;
+
+        @Option(names = {"--nvme-storage"}, description = "Restrict the Seqera scheduler to Azure VM sizes that provide local SSD storage for faster I/O.")
+        public Boolean nvmeEnabled;
     }
 
     public static class AdvancedOptions {
diff --git a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java
index eeea3031..fa832155 100644
--- a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java
+++ b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java
@@ -75,13 +75,11 @@ public GoogleCloudConfig computeConfig() throws ApiException, IOException {
                 .zone(zone);
 
         if (sched != null) {
-            SchedConfig schedConfig = new SchedConfig();
-            if (sched.provisioningModel != null) {
-                schedConfig.provisioningModel(sched.provisioningModel);
-            }
-            if (sched.machineTypes != null) {
-                schedConfig.machineTypes(sched.machineTypes);
-            }
+            SchedConfig schedConfig = new SchedConfig()
+                    .provisioningModel(sched.provisioningModel)
+                    .machineTypes(sched.machineTypes)
+                    .predictionModel(sched.predictionModel)
+                    .nvmeEnabled(sched.nvmeEnabled);
             config.schedConfig(schedConfig);
         }
 
@@ -148,6 +146,12 @@ public static class SchedOptions {
 
         @Option(names = {"--sched-machine-types"}, description = "Compute Engine machine types for compute nodes managed by the Seqera scheduler. Comma-separated list (e.g., n2-standard-4,c2-standard-8). Leave empty to let the scheduler select the most cost-effective types.", split = ",")
         public List<String> machineTypes;
+
+        @Option(names = {"--prediction-model"}, description = "Model the Seqera scheduler uses to predict task resource requirements. Suggested values: none, qr/v1, qr/v2, qr/v3. If absent, the scheduler default (none) applies.")
+        public String predictionModel;
+
+        @Option(names = {"--nvme-storage"}, description = "Restrict the Seqera scheduler to Compute Engine machine types that provide local SSD (NVMe) storage for faster I/O.")
+        public Boolean nvmeEnabled;
     }
 
     public static class AdvancedOptions {
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/IdpGroupsCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/IdpGroupsCmd.java
new file mode 100644
index 00000000..eb5b4f66
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/IdpGroupsCmd.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations;
+
+import io.seqera.tower.cli.commands.AbstractRootCmd;
+import io.seqera.tower.cli.commands.organizations.idpgroups.AddCmd;
+import io.seqera.tower.cli.commands.organizations.idpgroups.DeleteCmd;
+import io.seqera.tower.cli.commands.organizations.idpgroups.ListCmd;
+import picocli.CommandLine.Command;
+
+@Command(
+        name = "idp-groups",
+        description = "Manage the organization IdP group catalog used to link teams to IdP groups. Requires IdP claims mapping to be enabled for the organization.",
+        subcommands = {
+                ListCmd.class,
+                AddCmd.class,
+                DeleteCmd.class,
+        }
+)
+public class IdpGroupsCmd extends AbstractRootCmd {
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/ScimCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/ScimCmd.java
new file mode 100644
index 00000000..020c0cf6
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/ScimCmd.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations;
+
+import io.seqera.tower.cli.commands.AbstractRootCmd;
+import io.seqera.tower.cli.commands.organizations.scim.CreateTokenCmd;
+import io.seqera.tower.cli.commands.organizations.scim.RevokeTokenCmd;
+import io.seqera.tower.cli.commands.organizations.scim.RotateTokenCmd;
+import io.seqera.tower.cli.commands.organizations.scim.ViewCmd;
+import picocli.CommandLine.Command;
+
+@Command(
+        name = "scim",
+        description = "Manage SCIM provisioning for the organization. Requires IdP claims mapping to be enabled for the organization.",
+        subcommands = {
+                ViewCmd.class,
+                CreateTokenCmd.class,
+                RotateTokenCmd.class,
+                RevokeTokenCmd.class,
+        }
+)
+public class ScimCmd extends AbstractRootCmd {
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/AddCmd.java
new file mode 100644
index 00000000..4c6a9721
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/AddCmd.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.idpgroups;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.IdpGroupAdded;
+import io.seqera.tower.model.CreateIdpGroupRequest;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "add",
+        description = "Add an IdP group manually"
+)
+public class AddCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Option(names = {"-n", "--name"}, description = "IdP group name. Must match exactly the value your IdP sends in the groups claim.", required = true)
+    public String name;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new IdpGroupAdded(organizationRef, orgsApi().createOrganizationIdpGroup(orgId, new CreateIdpGroupRequest().displayName(name)));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/DeleteCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/DeleteCmd.java
new file mode 100644
index 00000000..555fd34a
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/DeleteCmd.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.idpgroups;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.IdpGroupDeleted;
+import picocli.CommandLine.ArgGroup;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "delete",
+        description = "Delete a manually added IdP group. Groups pushed by SCIM can't be deleted."
+)
+public class DeleteCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @ArgGroup(multiplicity = "1")
+    GroupRef group;
+
+    static class GroupRef {
+        @Option(names = {"-i", "--id"}, description = "IdP group numeric identifier.")
+        Long id;
+
+        @Option(names = {"-n", "--name"}, description = "IdP group name.")
+        String name;
+    }
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        Long groupId = group.id != null ? group.id : findIdpGroupByName(orgId, group.name).getId();
+
+        orgsApi().deleteOrganizationIdpGroup(orgId, groupId);
+
+        return new IdpGroupDeleted(organizationRef, group.name != null ? group.name : groupId.toString());
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/ListCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/ListCmd.java
new file mode 100644
index 00000000..6f626e3c
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/ListCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.idpgroups;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.IdpGroupsList;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "list",
+        description = "List IdP groups, both pushed by SCIM and added manually"
+)
+public class ListCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new IdpGroupsList(organizationRef, orgsApi().listOrganizationIdpGroups(orgId).getGroups());
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/CreateTokenCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/CreateTokenCmd.java
new file mode 100644
index 00000000..8d815412
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/CreateTokenCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimTokenCreated;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "create-token",
+        description = "Generate a SCIM bearer token. Revokes the active token, if any. The token is shown only once."
+)
+public class CreateTokenCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new ScimTokenCreated(organizationRef, orgsApi().createOrganizationScimToken(orgId), false);
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RevokeTokenCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RevokeTokenCmd.java
new file mode 100644
index 00000000..d14aafae
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RevokeTokenCmd.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimTokenRevoked;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "revoke-token",
+        description = "Revoke the active SCIM bearer token"
+)
+public class RevokeTokenCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        orgsApi().revokeOrganizationScimToken(orgId);
+        return new ScimTokenRevoked(organizationRef);
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RotateTokenCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RotateTokenCmd.java
new file mode 100644
index 00000000..48471727
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RotateTokenCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimTokenCreated;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "rotate-token",
+        description = "Revoke the active SCIM bearer token and generate a new one. The token is shown only once."
+)
+public class RotateTokenCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new ScimTokenCreated(organizationRef, orgsApi().rotateOrganizationScimToken(orgId), true);
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/ViewCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/ViewCmd.java
new file mode 100644
index 00000000..219feb64
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/ViewCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimConfigView;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "view",
+        description = "View SCIM configuration and token status"
+)
+public class ViewCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new ScimConfigView(organizationRef, orgsApi().describeOrganizationScimConfig(orgId));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java
index b45e373e..c7053dfe 100644
--- a/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java
@@ -43,6 +43,9 @@ public class AddCmd extends AbstractTeamsCmd {
     @CommandLine.Option(names = {"-d", "--description"}, description = "Team description. Free-text description providing context about the team's purpose, members, or project scope.")
     public String teamDescription;
 
+    @CommandLine.Option(names = {"--idp-group"}, description = "Link the team to this IdP group (display name, see 'tw organizations idp-groups list'). Team membership is then managed by the IdP.")
+    public String idpGroup;
+
     @CommandLine.Option(names = {"--overwrite"}, description = "Overwrite existing team. If a team with this name already exists in the organization, delete it first before creating the new one. Use with caution as this removes all team members and permissions.", defaultValue = "false")
     public Boolean overwrite;
 
@@ -56,6 +59,9 @@ protected Response exec() throws ApiException, IOException {
 
         CreateTeamRequest request = new CreateTeamRequest();
         request.setTeam(team);
+        if (idpGroup != null) {
+            request.setIdpGroupId(findIdpGroupByName(orgAndWorkspaceDbDto.getOrgId(), idpGroup).getId());
+        }
 
         if(overwrite) tryDeleteTeam(orgAndWorkspaceDbDto.getOrgId(), teamName);
 
diff --git a/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java b/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java
index 22da709d..bb6ef92a 100644
--- a/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java
@@ -21,6 +21,7 @@
 import io.seqera.tower.cli.responses.teams.TeamUpdated;
 import io.seqera.tower.model.TeamDbDto;
 import io.seqera.tower.model.UpdateTeamRequest;
+import picocli.CommandLine.ArgGroup;
 import picocli.CommandLine.Command;
 import picocli.CommandLine.Mixin;
 import picocli.CommandLine.Option;
@@ -43,6 +44,17 @@ public class UpdateCmd extends AbstractTeamsCmd {
     @Option(names = {"-d", "--description"}, description = "New team description.")
     public String description;
 
+    @ArgGroup
+    IdpGroup idpGroup;
+
+    static class IdpGroup {
+        @Option(names = {"--idp-group"}, description = "Link the team to this IdP group (display name, see 'tw organizations idp-groups list'). Team membership is then managed by the IdP.")
+        String name;
+
+        @Option(names = {"--unlink-idp-group"}, description = "Remove the IdP group link so team members can be managed manually again.")
+        boolean unlink;
+    }
+
     @Override
     protected Response exec() throws ApiException {
         Long orgId = findOrganizationByRef(organizationRef).getOrgId();
@@ -54,6 +66,12 @@ protected Response exec() throws ApiException {
                 .description(description != null ? description : team.getDescription())
                 .avatarId(avatarId(team.getAvatarUrl()));
 
+        if (idpGroup != null && idpGroup.unlink) {
+            request.idpGroupId(null);
+        } else if (idpGroup != null) {
+            request.idpGroupId(findIdpGroupByName(orgId, idpGroup.name).getId());
+        }
+
         teamsApi().updateOrganizationTeam(orgId, team.getTeamId(), request);
 
         return new TeamUpdated(organizationRef, request.getName());
diff --git a/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogView.java b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogView.java
new file mode 100644
index 00000000..d9bfd41a
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogView.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.responses.auditlogs;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import io.seqera.tower.cli.exceptions.TowerRuntimeException;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.AuditLogV2ResponseDto;
+import io.seqera.tower.model.AuditLogV2ResponseDtoActor;
+import io.seqera.tower.model.AuditLogV2ResponseDtoClient;
+import io.seqera.tower.model.AuditLogV2ResponseDtoTarget;
+
+import java.io.PrintWriter;
+import java.util.Objects;
+
+import static io.seqera.tower.cli.utils.FormatHelper.formatDate;
+import static io.seqera.tower.cli.utils.JsonHelper.prettyJson;
+
+public class AuditLogView extends Response {
+
+    public final AuditLogV2ResponseDto auditLog;
+
+    public AuditLogView(AuditLogV2ResponseDto auditLog) {
+        this.auditLog = auditLog;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        AuditLogV2ResponseDtoActor actor = auditLog.getActor() == null ? new AuditLogV2ResponseDtoActor() : auditLog.getActor();
+        AuditLogV2ResponseDtoClient client = auditLog.getClient() == null ? new AuditLogV2ResponseDtoClient() : auditLog.getClient();
+        AuditLogV2ResponseDtoTarget target = auditLog.getTarget() == null ? new AuditLogV2ResponseDtoTarget() : auditLog.getTarget();
+
+        out.println(ansi(String.format("%n  @|bold Audit log:|@%n")));
+        TableList table = new TableList(out, 2);
+        table.setPrefix("    ");
+        table.addRow("ID", auditLog.getId());
+        table.addRow("Timestamp", formatDate(auditLog.getTimestamp()));
+        table.addRow("Event", auditLog.getEvent() == null ? "" : auditLog.getEvent().getValue());
+        table.addRow("Correlation ID", Objects.toString(auditLog.getCorrelationId(), ""));
+        table.addRow("Actor", Objects.toString(actor.getUserName(), ""));
+        table.addRow("Actor email", Objects.toString(actor.getEmail(), ""));
+        table.addRow("Actor type", actor.getType() == null ? "" : actor.getType().getValue());
+        table.addRow("Client IP", Objects.toString(client.getIp(), ""));
+        table.addRow("User agent", Objects.toString(client.getUserAgent(), ""));
+        table.addRow("Target type", Objects.toString(target.getType(), ""));
+        table.addRow("Target ID", Objects.toString(target.getId(), ""));
+        table.addRow("Target name", Objects.toString(target.getName(), ""));
+        table.addRow("Organization", target.getOrganization() == null ? "" : Objects.toString(target.getOrganization().getName(), ""));
+        table.addRow("Workspace", target.getWorkspace() == null ? "" : Objects.toString(target.getWorkspace().getName(), ""));
+        table.print();
+
+        if (target.getState() != null) {
+            out.println(ansi(String.format("%n  @|bold Target state:|@%n")));
+            try {
+                out.println(prettyJson(target.getState()));
+            } catch (JsonProcessingException e) {
+                throw new TowerRuntimeException("Unable to format the audit log state: " + e.getMessage());
+            }
+        }
+        out.println("");
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsExported.java b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsExported.java
new file mode 100644
index 00000000..86279364
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsExported.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.responses.auditlogs;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import io.seqera.tower.cli.responses.Response;
+
+import java.util.Map;
+
+public class AuditLogsExported extends Response {
+
+    public final String file;
+
+    @JsonIgnore
+    private final String csv;
+
+    public AuditLogsExported(String file, String csv) {
+        this.file = file;
+        this.csv = csv;
+    }
+
+    @Override
+    public Object getJSON() {
+        return file != null ? this : Map.of("csv", csv);
+    }
+
+    @Override
+    public String toString() {
+        return file != null ? ansi(String.format("%n  @|yellow Audit logs exported to '%s'|@%n", file)) : csv;
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsList.java b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsList.java
new file mode 100644
index 00000000..b1ec90a2
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsList.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.responses.auditlogs;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.AuditLogV2ResponseDto;
+
+import java.io.PrintWriter;
+import java.util.List;
+import java.util.Objects;
+
+import static io.seqera.tower.cli.utils.FormatHelper.formatDate;
+
+public class AuditLogsList extends Response {
+
+    public final List<AuditLogV2ResponseDto> auditLogs;
+    public final String nextPageToken;
+
+    public AuditLogsList(List<AuditLogV2ResponseDto> auditLogs, String nextPageToken) {
+        this.auditLogs = auditLogs;
+        this.nextPageToken = nextPageToken;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        out.println(ansi(String.format("%n  @|bold Audit logs:|@%n")));
+        if (auditLogs == null || auditLogs.isEmpty()) {
+            out.println(ansi("    @|yellow No audit logs found|@"));
+            return;
+        }
+
+        TableList table = new TableList(out, 6, "ID", "Timestamp", "Event", "Actor", "Target type", "Target name");
+        table.setPrefix("    ");
+        auditLogs.forEach(log -> table.addRow(
+                log.getId(),
+                formatDate(log.getTimestamp()),
+                log.getEvent() == null ? "" : log.getEvent().getValue(),
+                log.getActor() == null ? "" : Objects.toString(log.getActor().getUserName(), ""),
+                log.getTarget() == null ? "" : Objects.toString(log.getTarget().getType(), ""),
+                log.getTarget() == null ? "" : Objects.toString(log.getTarget().getName(), "")
+        ));
+        table.print();
+        if (nextPageToken != null) {
+            out.println(String.format("%n  More logs available, use: --page-token %s", nextPageToken));
+        }
+        out.println("");
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupAdded.java b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupAdded.java
new file mode 100644
index 00000000..999195f2
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupAdded.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.model.IdpGroupEntry;
+
+public class IdpGroupAdded extends Response {
+
+    public final String organizationName;
+    public final IdpGroupEntry group;
+
+    public IdpGroupAdded(String organizationName, IdpGroupEntry group) {
+        this.organizationName = organizationName;
+        this.group = group;
+    }
+
+    @Override
+    public String toString() {
+        return ansi(String.format("%n  @|yellow IdP group '%s' (%d) added to %s organization|@%n", group.getDisplayName(), group.getId(), organizationName));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupDeleted.java b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupDeleted.java
new file mode 100644
index 00000000..a12e703a
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupDeleted.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+
+public class IdpGroupDeleted extends Response {
+
+    public final String organizationName;
+    public final String group;
+
+    public IdpGroupDeleted(String organizationName, String group) {
+        this.organizationName = organizationName;
+        this.group = group;
+    }
+
+    @Override
+    public String toString() {
+        return ansi(String.format("%n  @|yellow IdP group '%s' deleted at %s organization|@%n", group, organizationName));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupsList.java b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupsList.java
new file mode 100644
index 00000000..664fec8a
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupsList.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.IdpGroupEntry;
+
+import java.io.PrintWriter;
+import java.util.List;
+
+public class IdpGroupsList extends Response {
+
+    public final String organizationName;
+    public final List<IdpGroupEntry> groups;
+
+    public IdpGroupsList(String organizationName, List<IdpGroupEntry> groups) {
+        this.organizationName = organizationName;
+        this.groups = groups;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        out.println(ansi(String.format("%n  @|bold IdP groups for %s organization:|@%n", organizationName)));
+
+        if (groups == null || groups.isEmpty()) {
+            out.println(ansi("    @|yellow No IdP groups found|@"));
+            return;
+        }
+
+        TableList table = new TableList(out, 3, "ID", "Name", "Source");
+        table.setPrefix("    ");
+        groups.forEach(group -> table.addRow(group.getId().toString(), group.getDisplayName(), group.getSource() == null ? null : group.getSource().toString()));
+        table.print();
+        out.println("");
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/ScimConfigView.java b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimConfigView.java
new file mode 100644
index 00000000..4ccd8fa9
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimConfigView.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.DescribeScimConfigResponse;
+
+import java.io.PrintWriter;
+
+import static io.seqera.tower.cli.utils.FormatHelper.formatDate;
+
+public class ScimConfigView extends Response {
+
+    public final String organizationName;
+    public final DescribeScimConfigResponse scim;
+
+    public ScimConfigView(String organizationName, DescribeScimConfigResponse scim) {
+        this.organizationName = organizationName;
+        this.scim = scim;
+    }
+
+    @Override
+    public Object getJSON() {
+        return scim;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        out.println(ansi(String.format("%n  @|bold SCIM configuration for %s organization:|@%n", organizationName)));
+        TableList table = new TableList(out, 2);
+        table.setPrefix("    ");
+        table.addRow("Endpoint URL", scim.getEndpointUrl());
+        table.addRow("SSO active", String.valueOf(scim.getSsoActive()));
+        table.addRow("Active token", String.valueOf(scim.getHasActiveToken()));
+        table.addRow("Token", scim.getMaskedToken());
+        table.addRow("Token created", formatDate(scim.getTokenCreatedAt()));
+        table.addRow("Token last used", formatDate(scim.getTokenLastUsed()));
+        table.addRow("Groups", scim.getGroupCount() == null ? null : scim.getGroupCount().toString());
+        table.print();
+        out.println("");
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenCreated.java b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenCreated.java
new file mode 100644
index 00000000..8955c1c9
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenCreated.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.model.CreateScimTokenResponse;
+
+public class ScimTokenCreated extends Response {
+
+    public final String organizationName;
+    public final CreateScimTokenResponse scimToken;
+
+    @JsonIgnore
+    private final boolean rotated;
+
+    public ScimTokenCreated(String organizationName, CreateScimTokenResponse scimToken, boolean rotated) {
+        this.organizationName = organizationName;
+        this.scimToken = scimToken;
+        this.rotated = rotated;
+    }
+
+    @Override
+    public Object getJSON() {
+        return scimToken;
+    }
+
+    @Override
+    public String toString() {
+        return rotated
+                ? ansi(String.format("%n  @|yellow SCIM token rotated for %s organization. Copy it now, it won't be shown again:|@%n%n    %s%n%n  SCIM endpoint URL: %s%n", organizationName, scimToken.getToken(), scimToken.getEndpointUrl()))
+                : ansi(String.format("%n  @|yellow SCIM token generated for %s organization. Copy it now, it won't be shown again:|@%n%n    %s%n%n  SCIM endpoint URL: %s%n", organizationName, scimToken.getToken(), scimToken.getEndpointUrl()));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenRevoked.java b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenRevoked.java
new file mode 100644
index 00000000..1706f344
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenRevoked.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+
+public class ScimTokenRevoked extends Response {
+
+    public final String organizationName;
+
+    public ScimTokenRevoked(String organizationName) {
+        this.organizationName = organizationName;
+    }
+
+    @Override
+    public String toString() {
+        return ansi(String.format("%n  @|yellow SCIM token revoked for %s organization|@%n", organizationName));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java b/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java
index 6bfb7c58..f3d68849 100644
--- a/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java
+++ b/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java
@@ -41,6 +41,7 @@ public void toString(PrintWriter out) {
         table.addRow("Name", team.getName());
         table.addRow("Description", team.getDescription());
         table.addRow("Members", team.getMembersCount() == null ? null : team.getMembersCount().toString());
+        table.addRow("IdP group", team.getIdpGroupName());
         table.print();
         out.println("");
     }
diff --git a/src/test/java/io/seqera/tower/cli/auditlogs/AuditLogsCmdTest.java b/src/test/java/io/seqera/tower/cli/auditlogs/AuditLogsCmdTest.java
new file mode 100644
index 00000000..5dd198a1
--- /dev/null
+++ b/src/test/java/io/seqera/tower/cli/auditlogs/AuditLogsCmdTest.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.auditlogs;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import io.seqera.tower.cli.BaseCmdTest;
+import io.seqera.tower.cli.commands.enums.OutputType;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogView;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsExported;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsList;
+import io.seqera.tower.model.AuditLogV2ResponseDto;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+import org.mockserver.client.MockServerClient;
+import org.mockserver.model.MediaType;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import static io.seqera.tower.cli.utils.JsonHelper.parseJson;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockserver.matchers.Times.exactly;
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.model.HttpResponse.response;
+
+class AuditLogsCmdTest extends BaseCmdTest {
+
+    private static final String LOG = """
+            {
+              "id": "1001",
+              "timestamp": "2026-09-01T10:00:00Z",
+              "event": "agent_created",
+              "correlationId": "corr-1",
+              "actor": {"type": "user", "userId": 1264, "userName": "jordi", "email": "jordi@seqera.io"},
+              "client": {"ip": "10.0.0.1", "userAgent": "tw/0.42.0"},
+              "target": {"type": "agent", "id": "agt_1", "name": "fix-failed-runs",
+                         "organization": {"id": 27736513644467, "name": "organization1"},
+                         "workspace": {"id": 75887156211589, "name": "workspace1"}}
+            }
+            """;
+
+    private static final String CSV = "id,timestamp,event\n1001,2026-09-01T10:00:00Z,agent_created\n";
+
+    @BeforeEach
+    void init(MockServerClient mock) {
+        mock.reset();
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testList(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2")
+                        .withQueryStringParameter("timestampAfterOrEqual", "2026-09-01T00:00:00Z")
+                        .withQueryStringParameter("timestampBeforeOrEqual", "2026-09-30T23:59:59Z")
+                        .withQueryStringParameter("max", "1")
+                        .withQueryStringParameter("nextPageToken", "tok1"), exactly(1))
+                .respond(response().withStatusCode(200).withBody("{\"auditLogs\":[" + LOG + "],\"nextPageToken\":\"tok2\"}").withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "audit-logs", "list", "--after", "2026-09-01T00:00:00Z", "--before", "2026-09-30T23:59:59Z", "--max", "1", "--page-token", "tok1");
+
+        assertOutput(format, out, new AuditLogsList(List.of(parseJson(LOG, AuditLogV2ResponseDto.class)), "tok2"));
+    }
+
+    @Test
+    void testListRejectsInvalidDate(MockServerClient mock) {
+        ExecOut out = exec(mock, "audit-logs", "list", "--after", "yesterday");
+
+        assertEquals(2, out.exitCode);
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testView(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2/1001"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(LOG).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "audit-logs", "view", "-i", "1001");
+
+        assertOutput(format, out, new AuditLogView(parseJson(LOG, AuditLogV2ResponseDto.class)));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testExportToStdout(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2/export-csv")
+                        .withQueryStringParameter("timestampAfterOrEqual", "2026-09-01T00:00:00Z"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(CSV).withContentType(MediaType.parse("text/csv"))
+                        .withHeader("Content-Disposition", "attachment; filename=\"audit-logs.csv\""));
+
+        ExecOut out = exec(format, mock, "audit-logs", "export", "--after", "2026-09-01T00:00:00Z");
+
+        assertOutput(format, out, new AuditLogsExported(null, CSV));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testExportToFile(OutputType format, MockServerClient mock) throws IOException {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2/export-csv")
+                        .withQueryStringParameter("attributes", "state"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(CSV).withContentType(MediaType.parse("text/csv"))
+                        .withHeader("Content-Disposition", "attachment; filename=\"audit-logs.csv\""));
+
+        Path file = tempDir().resolve("export.csv");
+        ExecOut out = exec(format, mock, "audit-logs", "export", "--state", "-o", file.toString());
+
+        assertOutput(format, out, new AuditLogsExported(file.toString(), null));
+        assertEquals(CSV, Files.readString(file));
+    }
+}
diff --git a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java
index b35931e2..d352c640 100644
--- a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java
+++ b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java
@@ -832,4 +832,102 @@ void testAddWithFusionMetricsDisabled(MockServerClient mock) throws IOException
         assertEquals(0, out.exitCode);
         assertEquals(expected.toString(), out.stdOut);
     }
+
+    @Test
+    void testAddWithIntelligentComputeOptions(MockServerClient mock) throws IOException {
+        mock.reset();
+
+        // given
+        mock.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/credentials")
+                        .withQueryStringParameter("platformId", "aws-cloud"),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"aws\",\"description\":null,\"discriminator\":\"aws\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
+        );
+
+        mock.when(
+                request()
+                        .withMethod("POST")
+                        .withPath("/compute-envs")
+                        .withBody(json("""
+                                {
+                                    "computeEnv": {
+                                        "name": "my-aws-cloud-ic",
+                                        "platform": "aws-cloud",
+                                        "config": {
+                                            "workDir": "s3://my-bucket",
+                                            "region": "us-east-1",
+                                            "fusion2Enabled": true,
+                                            "waveEnabled": true,
+                                            "schedEnabled": true,
+                                            "schedConfig": {
+                                                "predictionModel": "qr/v3",
+                                                "nvmeEnabled": true,
+                                                "backendStrategy": "EC2",
+                                                "pool": {
+                                                    "enabled": true,
+                                                    "desiredWarm": 2,
+                                                    "scaleToZeroSecs": 600
+                                                }
+                                            }
+                                        },
+                                        "credentialsId": "6XfOhoztUq6de3Dw3X9LSb"
+                                    }
+                                }""")),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"computeEnvId\":\"isnEDBLvHDAIteOEF44ow\"}")
+        );
+
+        // when
+        ExecOut out = exec(mock, "compute-envs", "add", "aws-cloud",
+                "-n", "my-aws-cloud-ic",
+                "--work-dir",
+                "s3://my-bucket",
+                "-r",
+                "us-east-1",
+                "--sched-enabled",
+                "--prediction-model",
+                "qr/v3",
+                "--nvme-storage",
+                "--backend-strategy",
+                "EC2",
+                "--warm-pool",
+                "--warm-pool-size",
+                "2",
+                "--warm-pool-scale-to-zero",
+                "600"
+        );
+
+        // then
+        var expected = new ComputeEnvAdded("aws-cloud", "isnEDBLvHDAIteOEF44ow", "my-aws-cloud-ic", null, USER_WORKSPACE_NAME);
+        assertEquals("", out.stdErr);
+        assertEquals(0, out.exitCode);
+        assertEquals(expected.toString(), out.stdOut);
+    }
+
+    @Test
+    void testAddWithWarmPoolWithoutSizeFails(MockServerClient mock) {
+        mock.reset();
+
+        ExecOut out = exec(mock, "compute-envs", "add", "aws-cloud",
+                "-n", "my-aws-cloud-pool",
+                "--work-dir", "s3://my-bucket",
+                "-r", "us-east-1",
+                "--sched-enabled",
+                "--warm-pool"
+        );
+
+        assertTrue(out.stdErr.contains("Option --warm-pool requires --warm-pool-size greater than zero."), "Expected warm pool size error, got: " + out.stdErr);
+        assertEquals(1, out.exitCode);
+    }
 }
diff --git a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java
index 91de216b..53316145 100644
--- a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java
+++ b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java
@@ -242,4 +242,76 @@ void testAddWithScheduler(MockServerClient mock) throws IOException {
         assertEquals(0, out.exitCode);
         assertEquals(expected.toString(), out.stdOut);
     }
+
+    @Test
+    void testAddWithIntelligentComputeOptions(MockServerClient mock) throws IOException {
+        mock.reset();
+
+        // given
+        mock.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/credentials")
+                        .withQueryStringParameter("platformId", "azure-cloud"),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"azure\",\"description\":null,\"discriminator\":\"azure\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
+        );
+
+        mock.when(
+                request()
+                        .withMethod("POST")
+                        .withPath("/compute-envs")
+                        .withBody(json("""
+                                {
+                                    "computeEnv": {
+                                        "name": "my-azure-cloud-ic",
+                                        "platform": "azure-cloud",
+                                        "config": {
+                                            "workDir": "az://my-container",
+                                            "region": "eastus",
+                                            "resourceGroup": "my-resource-group",
+                                            "fusion2Enabled": true,
+                                            "waveEnabled": true,
+                                            "schedEnabled": true,
+                                            "schedConfig": {
+                                                "predictionModel": "qr/v3",
+                                                "nvmeEnabled": true
+                                            }
+                                        },
+                                        "credentialsId": "6XfOhoztUq6de3Dw3X9LSb"
+                                    }
+                                }""")),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"computeEnvId\":\"isnEDBLvHDAIteOEF44ow\"}")
+        );
+
+        // when
+        ExecOut out = exec(mock, "compute-envs", "add", "azure-cloud",
+                "-n", "my-azure-cloud-ic",
+                "--work-dir",
+                "az://my-container",
+                "-r",
+                "eastus",
+                "--resource-group",
+                "my-resource-group",
+                "--sched-enabled",
+                "--prediction-model",
+                "qr/v3",
+                "--nvme-storage"
+        );
+
+        // then
+        var expected = new ComputeEnvAdded("azure-cloud", "isnEDBLvHDAIteOEF44ow", "my-azure-cloud-ic", null, USER_WORKSPACE_NAME);
+        assertEquals("", out.stdErr);
+        assertEquals(0, out.exitCode);
+        assertEquals(expected.toString(), out.stdOut);
+    }
 }
diff --git a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java
index 05b347fc..904d7542 100644
--- a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java
+++ b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java
@@ -381,4 +381,76 @@ private static void mockCredentials(MockServerClient mock) {
                         .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"google\",\"description\":null,\"discriminator\":\"google\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
         );
     }
+
+    @Test
+    void testAddWithIntelligentComputeOptions(MockServerClient mock) throws IOException {
+        mock.reset();
+
+        // given
+        mock.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/credentials")
+                        .withQueryStringParameter("platformId", "google-cloud"),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"google\",\"description\":null,\"discriminator\":\"google\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
+        );
+
+        mock.when(
+                request()
+                        .withMethod("POST")
+                        .withPath("/compute-envs")
+                        .withBody(json("""
+                                {
+                                    "computeEnv": {
+                                        "name": "my-google-cloud-ic",
+                                        "platform": "google-cloud",
+                                        "config": {
+                                            "workDir": "gs://my-bucket",
+                                            "region": "us-central1",
+                                            "zone": "us-central1-a",
+                                            "fusion2Enabled": true,
+                                            "waveEnabled": true,
+                                            "schedEnabled": true,
+                                            "schedConfig": {
+                                                "predictionModel": "qr/v3",
+                                                "nvmeEnabled": true
+                                            }
+                                        },
+                                        "credentialsId": "6XfOhoztUq6de3Dw3X9LSb"
+                                    }
+                                }""")),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"computeEnvId\":\"isnEDBLvHDAIteOEF44ow\"}")
+        );
+
+        // when
+        ExecOut out = exec(mock, "compute-envs", "add", "google-cloud",
+                "-n", "my-google-cloud-ic",
+                "--work-dir",
+                "gs://my-bucket",
+                "-r",
+                "us-central1",
+                "-z",
+                "us-central1-a",
+                "--sched-enabled",
+                "--prediction-model",
+                "qr/v3",
+                "--nvme-storage"
+        );
+
+        // then
+        var expected = new ComputeEnvAdded("google-cloud", "isnEDBLvHDAIteOEF44ow", "my-google-cloud-ic", null, USER_WORKSPACE_NAME);
+        assertEquals("", out.stdErr);
+        assertEquals(0, out.exitCode);
+        assertEquals(expected.toString(), out.stdOut);
+    }
 }
diff --git a/src/test/java/io/seqera/tower/cli/organizations/OrganizationIdentityCmdTest.java b/src/test/java/io/seqera/tower/cli/organizations/OrganizationIdentityCmdTest.java
new file mode 100644
index 00000000..aeed15e0
--- /dev/null
+++ b/src/test/java/io/seqera/tower/cli/organizations/OrganizationIdentityCmdTest.java
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.organizations;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import io.seqera.tower.cli.BaseCmdTest;
+import io.seqera.tower.cli.commands.enums.OutputType;
+import io.seqera.tower.cli.responses.organizations.IdpGroupAdded;
+import io.seqera.tower.cli.responses.organizations.IdpGroupDeleted;
+import io.seqera.tower.cli.responses.organizations.IdpGroupsList;
+import io.seqera.tower.cli.responses.organizations.ScimConfigView;
+import io.seqera.tower.cli.responses.organizations.ScimTokenCreated;
+import io.seqera.tower.cli.responses.organizations.ScimTokenRevoked;
+import io.seqera.tower.model.CreateScimTokenResponse;
+import io.seqera.tower.model.DescribeScimConfigResponse;
+import io.seqera.tower.model.IdpGroupEntry;
+import io.seqera.tower.model.ListIdpGroupsResponse;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+import org.mockserver.client.MockServerClient;
+import org.mockserver.matchers.MatchType;
+import org.mockserver.model.MediaType;
+
+import static io.seqera.tower.cli.utils.JsonHelper.parseJson;
+import static org.mockserver.matchers.Times.exactly;
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.model.HttpResponse.response;
+import static org.mockserver.model.JsonBody.json;
+
+class OrganizationIdentityCmdTest extends BaseCmdTest {
+
+    private static final String ORG_PATH = "/orgs/27736513644467";
+
+    private static final String IDP_GROUPS = """
+            {"groups": [{"id": 5, "displayName": "eng-admins", "source": "SCIM"}, {"id": 6, "displayName": "eng", "source": "MANUAL"}]}
+            """;
+
+    private static final String SCIM_TOKEN = """
+            {"endpointUrl": "https://tower.example/api/scim/v2", "maskedToken": "sqscim_ab...", "token": "sqscim_abcdef"}
+            """;
+
+    @BeforeEach
+    void mockUserWorkspaces(MockServerClient mock) {
+        mock.when(request().withMethod("GET").withPath("/user-info"))
+                .respond(response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(request().withMethod("GET").withPath("/user/1264/workspaces"))
+                .respond(response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsList(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("GET").withPath(ORG_PATH + "/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "list", "-o", "organization1");
+
+        assertOutput(format, out, new IdpGroupsList("organization1", parseJson(IDP_GROUPS, ListIdpGroupsResponse.class).getGroups()));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsAdd(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        String created = "{\"id\": 7, \"displayName\": \"data-team\", \"source\": \"MANUAL\"}";
+        mock.when(
+                request().withMethod("POST").withPath(ORG_PATH + "/idp-groups")
+                        .withBody(json("{\"displayName\": \"data-team\"}", MatchType.STRICT)), exactly(1)
+        ).respond(response().withStatusCode(200).withBody(created).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "add", "-o", "organization1", "-n", "data-team");
+
+        assertOutput(format, out, new IdpGroupAdded("organization1", parseJson(created, IdpGroupEntry.class)));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsDeleteByName(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("GET").withPath(ORG_PATH + "/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(request().withMethod("DELETE").withPath(ORG_PATH + "/idp-groups/6"), exactly(1))
+                .respond(response().withStatusCode(204));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "delete", "-o", "organization1", "-n", "eng");
+
+        assertOutput(format, out, new IdpGroupDeleted("organization1", "eng"));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsDeleteById(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("DELETE").withPath(ORG_PATH + "/idp-groups/6"), exactly(1))
+                .respond(response().withStatusCode(204));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "delete", "-o", "organization1", "-i", "6");
+
+        assertOutput(format, out, new IdpGroupDeleted("organization1", "6"));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimView(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        String body = """
+                {"endpointUrl": "https://tower.example/api/scim/v2", "groupCount": 3, "hasActiveToken": true, "maskedToken": "sqscim_ab...",
+                 "ssoActive": true, "tokenCreatedAt": "2026-09-01T10:00:00Z", "tokenLastUsed": null}
+                """;
+        mock.when(request().withMethod("GET").withPath(ORG_PATH + "/scim/config"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(body).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "view", "-o", "organization1");
+
+        assertOutput(format, out, new ScimConfigView("organization1", parseJson(body, DescribeScimConfigResponse.class)));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimCreateToken(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("POST").withPath(ORG_PATH + "/scim/token"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(SCIM_TOKEN).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "create-token", "-o", "organization1");
+
+        assertOutput(format, out, new ScimTokenCreated("organization1", parseJson(SCIM_TOKEN, CreateScimTokenResponse.class), false));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimRotateToken(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("POST").withPath(ORG_PATH + "/scim/token/rotate"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(SCIM_TOKEN).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "rotate-token", "-o", "organization1");
+
+        assertOutput(format, out, new ScimTokenCreated("organization1", parseJson(SCIM_TOKEN, CreateScimTokenResponse.class), true));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimRevokeToken(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("DELETE").withPath(ORG_PATH + "/scim/token"), exactly(1))
+                .respond(response().withStatusCode(204));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "revoke-token", "-o", "organization1");
+
+        assertOutput(format, out, new ScimTokenRevoked("organization1"));
+    }
+}
diff --git a/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java b/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java
index 28116771..dee16c98 100644
--- a/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java
+++ b/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java
@@ -375,7 +375,11 @@ void testDeleteTeam(OutputType format, MockServerClient mock) {
 
     private static final String TEAM = """
             {"team": {"teamId": 69076469523589, "name": "team-test-1", "description": "a new team", "membersCount": 2,
-                      "avatarUrl": "https://tower.example/api/avatars/av123"}}
+                      "avatarUrl": "https://tower.example/api/avatars/av123", "idpGroupId": null, "idpGroupName": null}}
+            """;
+
+    private static final String IDP_GROUPS = """
+            {"groups": [{"id": 5, "displayName": "eng-admins", "source": "SCIM"}, {"id": 6, "displayName": "eng", "source": "MANUAL"}]}
             """;
 
     private void mockUserWorkspaces(MockServerClient mock) {
@@ -420,6 +424,70 @@ void testUpdateKeepsUnsetFieldsAndAvatar(OutputType format, MockServerClient moc
         assertOutput(format, out, new TeamUpdated("organization1", "team-renamed"));
     }
 
+    @Test
+    void testUpdateLinksIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mockDescribeTeam(mock);
+        mock.when(request().withMethod("GET").withPath("/orgs/27736513644467/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(
+                request().withMethod("PUT").withPath(TEAM_PATH)
+                        .withBody(json("""
+                                {"name": "team-test-1", "description": "a new team", "avatarId": "av123", "idpGroupId": 6}
+                                """, MatchType.STRICT)), exactly(1)
+        ).respond(response().withStatusCode(204));
+
+        ExecOut out = exec(mock, "teams", "update", "-o", "organization1", "-i", "69076469523589", "--idp-group", "eng");
+
+        assertOutput(OutputType.console, out, new TeamUpdated("organization1", "team-test-1"));
+    }
+
+    @Test
+    void testUpdateUnlinksIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mockDescribeTeam(mock);
+        mock.when(
+                request().withMethod("PUT").withPath(TEAM_PATH)
+                        .withBody(json("""
+                                {"name": "team-test-1", "description": "a new team", "avatarId": "av123", "idpGroupId": null}
+                                """, MatchType.STRICT)), exactly(1)
+        ).respond(response().withStatusCode(204));
+
+        ExecOut out = exec(mock, "teams", "update", "-o", "organization1", "-i", "69076469523589", "--unlink-idp-group");
+
+        assertOutput(OutputType.console, out, new TeamUpdated("organization1", "team-test-1"));
+    }
+
+    @Test
+    void testUpdateWithUnknownIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mockDescribeTeam(mock);
+        mock.when(request().withMethod("GET").withPath("/orgs/27736513644467/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(mock, "teams", "update", "-o", "organization1", "-i", "69076469523589", "--idp-group", "missing");
+
+        assertEquals(errorMessage(out.app, new TowerException("IdP group 'missing' not found in organization '27736513644467'")), out.stdErr);
+        assertEquals(1, out.exitCode);
+    }
+
+    @Test
+    void testAddWithIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mock.when(request().withMethod("GET").withPath("/orgs/27736513644467/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(
+                request().withMethod("POST").withPath("/orgs/27736513644467/teams")
+                        .withBody(json("""
+                                {"team": {"name": "team-test"}, "idpGroupId": 5}
+                                """, MatchType.ONLY_MATCHING_FIELDS)), exactly(1)
+        ).respond(response().withStatusCode(200).withBody(loadResource("teams/teams_add")).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(mock, "teams", "add", "-o", "organization1", "-n", "team-test", "--idp-group", "eng-admins");
+
+        assertOutput(OutputType.console, out, new TeamAdded("organization1", "team-test"));
+    }
+
     @ParameterizedTest
     @EnumSource(OutputType.class)
     void testWorkspaces(OutputType format, MockServerClient mock) throws JsonProcessingException {