How to Configure SCIM User Provisioning

How to Configure SCIM User Provisioning

Help keep your app's user list up to date automatically—pushing profile updates and removing access when someone leaves your organization.

This article assumes you have already set up Single Sign-On. If you haven't yet, start with How to Configure SAML Single Sign-On (SSO) and come back here afterward.

You don't need to be technical to follow this guide—most of the work is copying a value from one screen and pasting it into another.

Please read this first—it prevents the most common misunderstanding

SCIM does NOT create or sync your users into the app. New members are added to your app when they log in for the first time through SSO—not by SCIM. What SCIM does handle is keeping existing users up to date: pushing profile updates and deactivating access when someone is removed or disabled in your identity provider.

Changes are not instant. Synchronization can take up to 1 hour (it is not real-time), and the exact timing depends on your identity provider. If a change doesn't appear right away, this is expected—please allow up to an hour before troubleshooting.

A few terms, in plain language

• Identity provider (IdP) – Your company's login system that stores your users, such as Microsoft Entra ID (formerly Azure AD), Okta, or Google Workspace.
• SCIM – The behind-the-scenes connection that lets your identity provider send user updates and removals to your app automatically.
• Provisioning – The general term for creating, updating, and removing user access. With SCIM, updates and removals happen automatically.

Requirements

• Administrator access to your Control Panel.
• Administrator access to your company's identity provider (for example, Microsoft Entra ID / Azure AD).
• Single Sign-On (SAML) already set up. See How to Configure SAML Single Sign-On (SSO).

Step 1 – Open your integration in the Control Panel

1. Log in to your Control Panel.
2. Go to User Access → Settings.
3. Open the sign-in integration you created during SAML setup.

Step 2 – Copy your SCIM details from the Control Panel

1. In the integration, find the SCIM Webhook URL and the SCIM Token.
2. Copy both—you'll paste them into your identity provider in the next step. (Think of the URL as the address changes are sent to, and the token as a password that proves the connection is trusted. Keep the token private.)

Step 3 – Set up provisioning in your identity provider

1. In your identity provider, create a new provisioning configuration.
2. Set the authentication method to Bearer Authentication.
3. Paste in the values you copied from the Control Panel:

• SCIM Webhook URL → the provisioning URL / tenant URL field
• SCIM Token → the secret token field

1. Choose your provisioning scope—which users this should apply to.

Important: If you are using SAML integration, your provisioning scope must match your SAML login setting. The value you chose for who can log in (in the SAML article, Step 7 under App Properties) must match here. Follow the one option below that matches your SAML setting.

Option A – If you allowed ALL users to log in (SAML set to all users)

Use this option to enable any user to login in the app.

1. In your identity provider, open the provisioning configuration you just set up.
2. Find the Scope setting (it may be labeled "Scope" or "Users to sync").
3. Select the option to sync all users (in Microsoft Entra ID this is Sync all users and groups).
4. Save your change.
5. Continue to sub-step 5 below to start provisioning.

Option B – If you allowed ONLY ASSIGNED users to log in (SAML set to assigned users)

1. In your identity provider, open the provisioning configuration you just set up.
2. Find the Scope setting (it may be labeled "Scope" or "Users to sync").
3. Select the option to sync only assigned users (in Microsoft Entra ID this is Sync only assigned users and groups).
4. Assign the specific users or groups who should be synced: go to the application's Users and groups section, click Add user/group, and select the same people you allowed to log in.
5. Save your change.
6. Continue to sub-step 5 below to start provisioning.
7. Start provisioning. 

Step 4 – Confirm it's working

1. Make a small change to a test user in your identity provider (for example, update their name), or remove their access.
2. Wait up to 1 hour for the change to sync—remember, it is not real-time.
3. Check that the change appears for that user in the app.

Pro tips

• SCIM does not create users. Members are added to your app at first login through SSO. SCIM keeps existing users up to date and removes access when needed.
• Syncing takes up to 1 hour. Updates and deactivations are not real-time, and timing depends on your identity provider. Allow up to an hour before assuming something is wrong.
• Deactivations are automatic (once synced). If you disable or remove a user in your identity provider, the app revokes that user's access on the next sync.
• SCIM works alongside your login method. It uses a separate connection from SAML, so it can also be used with other sign-in methods.
• No new app build needed. Turning on SCIM does not require rebuilding your app or resubmitting it to the app stores.

Troubleshooting tips

• A change isn't showing up – Allow up to 1 hour for SCIM to sync. If it still hasn't appeared after that, recheck your provisioning setup and scope.
• A new employee isn't in the app – This is expected. SCIM does not create users—ask them to sign in once through SSO, which creates their account.
• The connection was rejected – Re-copy the SCIM Webhook URL and SCIM Token from the Control Panel and confirm the authentication method is set to Bearer Authentication.
• Some users aren't syncing – Check your provisioning scope to confirm those users or groups are included. Also make sure the scope matches your SAML login setting: if only assigned users can log in, SCIM should be set to the assigned users; if all users can log in, SCIM should be set to all users.