Skip to main content
SCIM provisioning is generally available. Your identity provider creates, updates, and deactivates env zero users and teams as changes happen, rather than at login.

​
Provisioning modes

Each organization runs in one provisioning mode, set in Organization Settings > SSO. Full SCIM turns off login-time provisioning. Users, teams, and admin roles come from your identity provider, and a user who is not already an organization member is denied login. JIT keeps login-time provisioning and rejects SCIM writes. A new SCIM configuration starts in Full SCIM. See provisioning modes for what changes for your users at their next login.

​
Groups become teams

Pushing a group from Okta or Microsoft Entra ID creates an env zero team with the group’s name and keeps its membership in sync. Project roles you assign to the team survive membership changes from your identity provider.

​
Token rotation

Rotate the SCIM bearer token without a provisioning outage. The previous token keeps working for 24 hours, so you can update your identity provider before it expires.

​
Reconcile

Compare your identity provider’s SCIM data against env zero users and teams. The check is read-only and reports organization members who predate SCIM, along with group mappings whose team no longer exists. Applying the fixes runs as a background job, and never creates, renames, or deletes teams.

​
Set it up