SCIM Provisioning
1. What it is
A SCIM connection lets your identity provider — Microsoft Entra ID, Okta, OneLogin, JumpCloud, or an HR system that speaks SCIM 2.0 such as Workday or UKG — manage your people here. The provider pushes changes: it creates people, fills their profile from the field mapping, switches their access off and on, and manages groups.
- Where: Admin → Integrations → Identity Providers, then Set up SCIM provisioning. Only administrators can see or change it.
- What it never does: it never sets a password, and it never makes anyone an administrator. Your own Provisioning Rules can make someone a Member or Manager from the groups the provider sends.
- What it is not: it is not single sign-on. How people sign in is set up separately; the connection can be linked to a sign-in so the two work together.
2. Standing it up
- Go to Admin → Integrations → Identity Providers and choose Set up SCIM provisioning.
- Name the connection, choose your identity provider, and choose the Linked sign-in your people use (choose None for an HR system: new people then get an invitation).
- On the connection’s page, copy the Tenant URL and the bearer token. The token is shown once; if you lose it, Replace it and paste the new one into your provider.
- In your provider, paste them into its provisioning settings. In Microsoft Entra, open your enterprise application → Provisioning, set Provisioning Mode to Automatic, and paste the Tenant URL and the token as the Secret Token. Select Test Connection, then save.
- Assign a few people first, and switch provisioning on. Entra sends the first people within minutes, then checks for changes about every 40 minutes. Provision on demand sends one person straight away.
- Back on the connection’s page, the Activity list shows every request your provider sent.
Microsoft Entra’s own app provisioning signs in with the Secret Token. Leave the connection’s authentication on the bearer token for Entra.
3. What the provider owns, and what stays yours
| Field | Who decides |
|---|---|
| First name, last name, email, and whether they can sign in | The provider. These are locked on the profile and say Managed by your provider. |
| Job title, department, phone, time zone, hire date (when the field mapping fills them) | The provider fills them. An edit made here stays: the provider stops updating that field for that person, and their profile says Edited here, with a button to use the provider’s values again. |
| Everything the field mapping does not fill | You. |
A person who also belongs to another organization keeps their own profile: the provider manages their access here but does not write their profile fields.
4. Leavers, and switching people off here
When the provider switches someone off (or removes them), they are switched off here: their sessions end, they get a separation date, and they can use the Former Employee Portal.
The provider decides access for the people it holds. If you deactivate one of them in People, switch them off in the provider too: the next time the provider sends them as active, their access comes back and the separation details entered here are cleared. The People list marks them From your provider, their profile says Provisioned by it, and the Deactivate and Delete confirmations remind you.
5. Groups
Groups the provider pushes become employee groups whose members follow the provider. People you add to such a group by hand stay, and are listed as added by hand.
Turn on Also create a workspace for each pushed group to give each group a workspace whose members follow the provider. A group gets its workspace the next time the provider sends it; Microsoft Entra resends only groups that change, so restart provisioning in Entra to send them all. People added to the employee group by hand are not added to its workspace: add them in the workspace.
6. Pausing and removing
- Pause stops the provider: its requests are refused until you Enable the connection again. The connection reads Inactive, and the provider keeps its lock on the people it holds, so nothing edited over the pause is put back silently.
- Remove this connection stops the provider for good. Nobody is removed: the people stay members, pushed groups stay as ordinary employee groups, and workspaces stay with their owner, who can then manage their members. The request log goes with the connection.
7. When something looks wrong
- Check setup says whether this side is ready to accept your provider. It cannot test the provider itself; use Test Connection in your provider.
- Activity lists every request, with any refusal and its reason. A refused request can be Replayed once the cause is fixed.
- Needs review holds people who could not be linked automatically: someone who also belongs to another organization, or who is managed by another source.
More help
- Single sign-on: Admin → Integrations → Single sign-on (SSO Configurations).
- Role rules for pushed groups: Admin → People → Provisioning Rules.
- Google Workspace, which this app pulls from rather than receiving pushes: see Google Workspace Sync Overview.