SCIM Provisioning
Automate user provisioning and deprovisioning with SCIM 2.0 integration. Connect OAuth42 with your identity provider for seamless user lifecycle management.
What is SCIM?
SCIM (System for Cross-domain Identity Management) is an open standard for automating the exchange of user identity information between identity domains or IT systems.
OAuth42's SCIM 2.0 implementation allows you to:
- Automate user provisioning - Automatically create user accounts when new employees join
- Sync user attributes - Keep user profiles up-to-date across systems
- Manage group memberships - Automatically add/remove users from groups
- Deprovision users - Automatically deactivate accounts when employees leave
Setting Up SCIM
Generate SCIM Token
First, generate a SCIM bearer token in your OAuth42 dashboard:
- Log in to the OAuth42 Dashboard
- Navigate to Settings → Integrations → SCIM
- Click "Generate SCIM Token"
- Save the token securely (you won't be able to view it again)
Configure Your Identity Provider
Configure your identity provider (Okta, Azure AD, Google Workspace, etc.) to use OAuth42's SCIM endpoints:
SCIM Endpoint Configuration:
https://api.oauth42.com/scim/v2Bearer <your-scim-token>Test the Integration
Verify that your SCIM integration is working correctly:
- Create a test user in your identity provider
- Verify the user appears in your OAuth42 dashboard
- Update the user's attributes (email, name, etc.)
- Confirm changes are reflected in OAuth42
- Deactivate the user and verify they're deactivated in OAuth42
Supported Identity Providers
Azure Active Directory
Enterprise-grade integration with Microsoft 365 and Azure AD.
Azure AD SCIM GuideSCIM API Reference
OAuth42 implements SCIM 2.0 endpoints for user and group management:
GET /scim/v2/UsersList usersRetrieve a list of users with optional filtering and pagination.
POST /scim/v2/UsersCreate userCreate a new user with specified attributes.
PATCH /scim/v2/Users/:idUpdate userUpdate user attributes using SCIM PATCH operations.
DELETE /scim/v2/Users/:idDelete userDeactivate or remove a user from the system.
Troubleshooting
Authentication Failures
If you're seeing 401 Unauthorized errors:
- Verify your SCIM token is correctly configured in your IdP
- Ensure the token hasn't expired (tokens are valid for 1 year)
- Check that the Authorization header uses "Bearer" prefix
Users Not Syncing
If users aren't being created or updated:
- Verify SCIM provisioning is enabled in your IdP
- Check attribute mappings match OAuth42's schema
- Review SCIM logs in your dashboard for error details
- Ensure required fields (email, username) are being sent