🪪 SCIM 2.0

System for Cross-domain Identity Management — standardized identity API (RFC 7644). Works for Okta, Azure SCIM-enabled apps, etc.

Identification

• vendor key: scim
• engine: scim
• default role: bidirectional
• type: Generic protocol
• vendor docs: https://datatracker.ietf.org/doc/html/rfc7644

Supported auth methods

• bearer
• basic
• oauth2_client_credentials

The connector runs in all three execution modes (in process, agent, tunnel). Certificate verification is on by default; your tenant's Trusted TLS certificates and a per-connector skip-verify option apply in every mode (see Tier-3 Hybrid Architecture). Reads page with startIndex and count. When the server reports a totalResults and then returns an empty page before reaching it, the read is recorded as short: the run is partial, and a partial run removes nothing, so accounts the server did not return are not treated as deleted. Writes use SCIM PATCH operations (add, replace, remove), and fall back to a full PUT for servers that do not support PATCH, such as Slack.

What it writes

Create a user (POST /Users), update attributes, disable and re-enable (active false or true), add and remove group members, and create, rename and delete groups. Group membership is the only assignment kind SCIM has; an owner assignment is refused. There is no user hard-delete: a leaver is disabled. SCIM has no standard way to set a password, so this connector sends none and delivers none.

Importable objects (2)

Object types the wizard offers to import out of the box.

Users

• name: users
• iga_target: identity
• path: /Users

SCIM Users resource.

Default field mappings:

IGA field	Expression	Required
business_id	{{ id }}	✓
identity_id	{{ userName }}	✓
correlation_email	{{ emails[0].value }}
first_name	{{ name.givenName }}
last_name	{{ name.familyName }}
display_name	{{ displayName }}
employee_id	{{ externalId }}
native_account_name	{{ userName }}	✓
identity_business_id	{{ externalId|if_null(userName)|lower }}
status	{{ 'active' if active else 'suspended' }}
is_privileged	{{ false }}

Groups

• name: groups
• iga_target: entitlement
• path: /Groups

SCIM Groups resource.

Default field mappings:

IGA field	Expression	Required
business_id	{{ id }}	✓
name	{{ displayName }}	✓
description	{{ externalId|if_null('') }}
native_identifier	{{ id }}
risk_level	'low'

Onboarding setup checklist

Enable SCIM 2.0 in the target system and retrieve the bearer token + endpoint URL. Most SaaS providers have a 'SCIM 2.0 Provisioning' feature in their admin settings.

Estimated time: ~10 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.