Skip to main content
SCIM (System for Cross-domain Identity Management) lets your identity provider create, update, and deactivate env zero users and teams as changes happen, instead of only when someone logs in. When you remove a user in your IdP, their env zero access is revoked on the next SCIM sync rather than at their next login attempt.

​
Prerequisites

  • An SSO connection using SAML or Microsoft Entra ID (Azure AD)
  • An IdP that maps the user’s email address to the SCIM userName attribute and sends externalId. env zero rejects a user create that is missing either attribute.
Configuring SCIM, changing the provisioning mode, rotating the token, and running reconcile all require the Edit Organization Settings permission.

​
Provisioning modes

Each organization runs in one provisioning mode. The mode controls whether users are provisioned at login (JIT), whether env zero accepts SCIM writes, and whether users who are not organization members can log in at all. Hybrid (legacy) covers organizations that used SCIM for deprovisioning before full SCIM shipped. The option appears in the mode selector only for those organizations; all others cannot select it. An organization that leaves Hybrid (legacy) can return to it, but deleting the SCIM configuration removes the option permanently.
SCIM Provisioning section with the Provisioning Mode selector showing JIT, Hybrid (legacy), and Full SCIM options
A mode change is stored immediately and applies to each user at their next login. SCIM writes follow the new mode on the next request.

​
Set up SCIM

Generating a SCIM token puts the organization in Full SCIM mode: login-time provisioning stops, and users who are not already organization members are denied login. If your users depend on being provisioned at login, change the provisioning mode right after generating the token, before anyone is locked out.
1

Open SSO settings

Go to Organization Settings > SSO. Below your SSO connection is the SCIM Provisioning section.
SCIM Provisioning section showing the Generate SCIM Token button
2

Generate a SCIM token

Click Generate SCIM Token. env zero creates a bearer token and a SCIM endpoint URL for the organization.
3

Copy the token and endpoint URL

The SCIM Token Created dialog shows the SCIM Endpoint URL and the Bearer Token. Copy both.
The bearer token is shown once. If you misplace it, rotate the token to get a new one; the previous token keeps working until the grace period ends. If the token may have been exposed, delete the configuration instead, which revokes it immediately, and generate a new one.
4

Set the provisioning mode

A new SCIM configuration starts in Full SCIM mode. Confirm the Provisioning Mode value in the SCIM Provisioning section before you point your IdP at env zero.
SCIM Provisioning configured state showing the endpoint URL, creation date, and provisioning mode set to Full SCIM
5

Configure your identity provider

Use the endpoint URL and bearer token in your IdP:For any other IdP that supports SCIM 2.0, point it at the same endpoint with the bearer token in the Authorization header. env zero publishes /scim/v2/ServiceProviderConfig, /scim/v2/ResourceTypes, and /scim/v2/Schemas for discovery. Filtering is supported; sorting, bulk operations, and ETags are not.

​
Changing the provisioning mode

Select a different Provisioning Mode in the SCIM Provisioning section and confirm the dialog. Switching to Full SCIM shows the login-time SAML configuration that stops being applied, so you can see which admin group and team filter you are turning off.

​
User attributes

env zero stores a subset of the SCIM core user schema: Attributes env zero has nowhere to store, such as title, phoneNumbers, addresses, roles, and the Enterprise User extension, are accepted and ignored on both create and update. A stock IdP attribute mapping does not need to be trimmed. A user created over SCIM is provisioned into the SCIM organization and every sub-organization mapped to it.

​
Deactivation

DELETE /scim/v2/Users/{id} and an update with active: false remove the user from the SCIM organization and its sub-organizations. The underlying login is blocked only when no organization memberships remain, so deprovisioning a user from one organization never locks them out of another.

​
Group to team mapping

Pushing a group to env zero creates an env zero team with the group’s display name and links the two. From then on, member changes in the IdP group are applied to the team.
  • Matching is by name. Pushing a group whose display name matches an existing team returns HTTP 409 with A group named <name> already exists. Rename the group in your IdP or rename the env zero team, then push again.
  • Renaming a group renames the team. A rename to a name another team already uses returns the same 409.
  • Members must exist in env zero first. Adding a member who is not provisioned into the organization or one of its sub-organizations returns HTTP 400. Assign the user to the application in your IdP so the user is provisioned before the group push carries them.
  • Removing a member removes their team membership, and leaves the user account alone.
  • Unlinking or deleting the group removes the mapping only. The env zero team and its members are preserved, and env zero does not recreate the mapping unless the IdP pushes the group again.
Permissions stay in env zero: assign project roles to the team, and they survive membership changes from your IdP.
In Full SCIM mode the login-time team sync described in Sync roles & groups from your IdP no longer runs. Teams come from group pushes instead, so any group you relied on for team membership needs to be pushed over SCIM.

​
Rotate the SCIM token

Rotation issues a new bearer token while the current one keeps working for a 24 hour grace period, so you can update your IdP without a provisioning outage.
1

Rotate

In the SCIM Provisioning section, click Rotate Token and confirm.
2

Copy the new token

The SCIM Token Rotated dialog shows the new bearer token and the expiry of the previous one. The new token is shown once.
3

Update your IdP

Replace the token in your IdP’s SCIM configuration and run its connection test. Until you do, provisioning continues on the old token.
Old Token Expires At in the SCIM Provisioning section shows how long the previous token stays valid. After that time, requests using it fail with HTTP 401.

​
Reconcile users and teams

Reconcile compares your identity provider’s SCIM data against env zero users and teams and reports drift. It is available in Full SCIM and Hybrid (legacy) modes. Click Reconcile in the SCIM Provisioning section. The check is read-only and reports:
  • Users missing SCIM ownership - organization members who signed in through SAML but are not marked as SCIM-owned, typically users who predate SCIM. Apply stamps SCIM ownership so later IdP updates and deactivations reach them.
  • Stale group mappings - mappings whose env zero team no longer exists. Apply unlinks them.
  • Teams without SCIM mapping - report only. Apply never creates, renames, or deletes teams.
To fix the reported drift, click Apply Fixes and confirm. The confirmation names the exact counts. Apply runs as a background job with progress, so you can close the page while it runs. A failed apply resumes from where it stopped on the next apply.

​
Revoke SCIM access

Click Delete Configuration in the SCIM Provisioning section. This invalidates the token immediately and stops all SCIM provisioning from your IdP. Existing users, teams, and memberships are not deleted.
Deleting the configuration while the organization is in Full SCIM mode leaves login-time provisioning disabled. Change the provisioning mode first if you want users provisioned at login again. Deleting also permanently removes Hybrid (legacy) eligibility; a new configuration cannot select that mode.

​
Next steps