Skip to content
Sandlayer
Start free trial

Security and compliance

SCIM provisioning

Creating, removing and role-mapping members automatically from your identity provider.

2 minute read

SCIM lets your identity provider create members here when somebody joins, remove them when they leave, and set their role from their group membership.

Connecting

Settings → SSO & SCIM. The page shows your base URL, which looks like https://your-app.example.com/api/scim/v2. Create a bearer token there; it is shown once. Paste both into your provider's provisioning settings.

We implement the parts of SCIM 2.0 that identity providers actually send: Users (list with a userName filter, create, read, replace, patch, delete) and Groups (list with a displayName filter, create, read, replace, patch including member add and remove, delete).

What happens on each action

  • A user is assigned to the application: an account is created here if the email is new, or an existing account is added to the workspace. There is no password; they sign in through SSO or a sign-in link.
  • A user is deactivated or unassigned: their membership is removed. Their account and any other workspaces they belong to are untouched.
  • A user is renamed: their display name here follows.

Workspace owners are never removed or demoted by SCIM, so a misconfigured provider cannot orphan a workspace.

Groups to roles

Under Groups to roles on the same page, map a group's display name to a role here. After that, group membership decides the role:

  • Somebody in a mapped group gets that role.
  • In several mapped groups, the most privileged role wins.
  • In no mapped group, their current role is left alone, so people you manage by hand stay as you set them.

Role changes made this way appear in the audit log and are sent to webhooks, marked as coming from SCIM.

Troubleshooting

  • 401 from your provider: the bearer token is wrong or was revoked. Create a new one.
  • Users appear but have no role you expect: check the group name matches exactly, case aside, and that the group is actually being pushed. The page lists the groups we have seen, which is the quickest way to spot a typo.
  • Somebody cannot be removed: they are an owner. Change their role first.

Did this miss something? Tell us.