SCIM Provisioning—which stands for System for Cross-domain Identity Management—is an open-standard protocol designed to automate the exchange of user identity information between identity providers (such as Okta, Azure AD, or OneLogin) and service providers (such as SaaS applications like Slack, Zoom, or Salesforce). SCIM’s goal is to make user provisioning and deprovisioning consistent, secure, and easy to implement, particularly in cloud-based environments.
Core Concepts of SCIM Provisioning
1. Standardized Data Model
SCIM defines a common schema for representing users, groups, and related entities. For example, the SCIM User resource includes attributes like username, email, given name, family name, etc. This standardization makes integration simpler between systems.
2. RESTful API
SCIM uses RESTful web services, typically over HTTPS, to create, read, update, and delete (CRUD) users and groups. The API endpoints are usually structured as:
- /Users
- /Groups
3. Automated User Lifecycle Management
SCIM enables automated workflows for:
- Provisioning: Automatically creates user accounts in downstream applications when accounts are added or updated in the identity provider.
- Deprovisioning: Automatically disables or deletes user accounts when a user leaves the organization or is removed from the identity provider.
- Updates: Syncs changes to user attributes (name, email, roles, etc.) in near-real time.
4. Interoperability
Because SCIM is an open standard, it’s supported by many identity providers and SaaS applications. This means organizations can easily connect their identity management system to a wide range of apps without custom integrations.
How SCIM Provisioning Works
- Onboarding (Provisioning):
- An admin adds a new user to the identity provider.
- The identity provider sends a SCIM request (usually a POST) to the application’s SCIM endpoint to create the user account.
- The application responds, confirming creation.
- Updates:
- If user information changes (e.g., email, title), the identity provider sends a PATCH or PUT request to update the user in the application.
- Group Management:
- SCIM can also manage group memberships, adding/removing users from groups in the application to align with the identity provider.
- Offboarding (Deprovisioning):
- When a user is removed or disabled in the identity provider, a DELETE or PATCH request is sent to the application, which disables or removes the account.
SCIM Protocol Versions
- SCIM 1.1: Early version, not widely adopted.
- SCIM 2.0: The current and most widely supported version, with a broader feature set and improved reliability.
Benefits of SCIM Provisioning
- Security: Ensures that access is automatically revoked when users leave, reducing the risk of orphaned accounts.
- Efficiency: Eliminates manual user management and reduces errors.
- Consistency: Keeps user data synchronized across systems.
- Scalability: Easily manage large numbers of users and apps.
Common SCIM Use Cases
- Enterprise SSO integrations: Automating account creation/deletion in SaaS apps when employees join or leave.
- Onboarding/Offboarding automation: Ensuring IT doesn’t have to manually provision or deprovision accounts.
- Role/Group-based access management: Automatically assigning users to the correct groups and permissions in connected applications.
Example SCIM Provisioning Workflow
- User added to HR system.
- HR system syncs with Identity Provider (IdP).
- IdP (e.g., Okta) detects a new user and sends an SCIM POST to the SaaS app.
- SaaS app provisions the user and assigns group membership.
- User leaves the company; HR system removes the user.
- IdP sends a SCIM DELETE or PATCH request to the SaaS app.
- SaaS app disables/deletes the user account.
In Summary
SCIM Provisioning is a protocol that automates the creation, update, and deletion of user accounts across identity systems and applications, using a standardized REST API and data model. It increases security, saves time, and ensures data consistency across cloud applications.
