Provision users with SCIM

Create, update and deactivate people automatically from Microsoft Entra ID, Okta or any SCIM 2.0 client.

For: Workspace admins (Enterprise add-on)

Steps

Verify your email domain first in Settings → Single sign-on → Verified domains. SCIM creates people only in verified domains.
Open Settings → SCIM provisioning and select Create token. Copy the token now — it is shown once.
In your identity provider, add a SCIM 2.0 provisioning connection with the SCIM base URL and the token (Entra ID: Enterprise application → Provisioning → Automatic; Okta: the app's Provisioning tab → Integration).
Map userName to the user's email (Entra ID: userPrincipalName or mail; Okta: email) and turn on Create, Update and Deactivate.
Under Group mappings, add each group whose members should get a role, a team or seats. Then assign or push those groups from your identity provider.
Watch the Provisioning log for each change and any errors.

Deactivating someone in your identity provider signs them out of every session in this workspace within a minute and frees their seats.
If no seat is left, the person isn't created and the security admins are alerted. Add seats in Settings → Billing and retry from your identity provider.
Regenerating the token stops the old one at once: update it in your identity provider straight away.
People added by hand or by single sign-on are matched by email, so SCIM takes them over instead of creating duplicates.

Still need help? Contact support

Create, update and deactivate people automatically from Microsoft Entra ID, Okta or any SCIM 2.0 client.

For: Workspace admins (Enterprise add-on)

Verify your email domain first in Settings → Single sign-on → Verified domains. SCIM creates people only in verified domains.
Open Settings → SCIM provisioning and select Create token. Copy the token now — it is shown once.
In your identity provider, add a SCIM 2.0 provisioning connection with the SCIM base URL and the token (Entra ID: Enterprise application → Provisioning → Automatic; Okta: the app's Provisioning tab → Integration).
Map userName to the user's email (Entra ID: userPrincipalName or mail; Okta: email) and turn on Create, Update and Deactivate.
Under Group mappings, add each group whose members should get a role, a team or seats. Then assign or push those groups from your identity provider.
Watch the Provisioning log for each change and any errors.

Deactivating someone in your identity provider signs them out of every session in this workspace within a minute and frees their seats.
If no seat is left, the person isn't created and the security admins are alerted. Add seats in Settings → Billing and retry from your identity provider.
Regenerating the token stops the old one at once: update it in your identity provider straight away.
People added by hand or by single sign-on are matched by email, so SCIM takes them over instead of creating duplicates.

Still need help? Contact support