> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SCIM provisioning
> Sync users and groups from your identity provider to env zero with SCIM 2.0, covering provisioning modes, group to team mapping, token rotation, and reconcile.
SCIM (System for Cross-domain Identity Management) lets your identity provider create, update, and deactivate env zero users and teams as changes happen, instead of only when someone logs in. When you remove a user in your IdP, their env zero access is revoked on the next SCIM sync rather than at their next login attempt.
## Prerequisites
* An [SSO connection](/guides/sso-integrations/self-service-sso) using SAML or Microsoft Entra ID (Azure AD)
* An IdP that maps the user's email address to the SCIM `userName` attribute and sends `externalId`. env zero rejects a user create that is missing either attribute.
Configuring SCIM, changing the provisioning mode, rotating the token, and running reconcile all require the **Edit Organization Settings** permission.
## Provisioning modes
Each organization runs in one provisioning mode. The mode controls whether users are provisioned at login (JIT), whether env zero accepts SCIM writes, and whether users who are not organization members can log in at all.
| Mode | Provisioning at login | SCIM writes | Login for a non-member |
| :------------------ | :-------------------------------------------------------------------------------------- | :--------------------- | :---------------------------------------- |
| **Full SCIM** | Off. No organization placement, no team sync, no admin role promotion from SAML groups. | Accepted | Denied with `user_not_provisioned` |
| **JIT** | On. Users, teams, and admin roles are synced from the SAML assertion at login. | Rejected with HTTP 403 | Allowed, the user is provisioned at login |
| **Hybrid (legacy)** | On, same as JIT. | Accepted | Allowed, the user is provisioned at login |
**Hybrid (legacy)** covers organizations that used SCIM for deprovisioning before full SCIM shipped. The option appears in the mode selector only for those organizations; all others cannot select it. An organization that leaves **Hybrid (legacy)** can return to it, but [deleting the SCIM configuration](#revoke-scim-access) removes the option permanently.
A mode change is stored immediately and applies to each user at their next login. SCIM writes follow the new mode on the next request.
## Set up SCIM
Generating a SCIM token puts the organization in **Full SCIM** mode: login-time provisioning stops, and users who are not already organization members are denied login. If your users depend on being provisioned at login, change the [provisioning mode](#provisioning-modes) right after generating the token, before anyone is locked out.
Go to **Organization Settings** > **SSO**. Below your SSO connection is the **SCIM Provisioning** section.
Click **Generate SCIM Token**. env zero creates a bearer token and a SCIM endpoint URL for the organization.
The **SCIM Token Created** dialog shows the **SCIM Endpoint URL** and the **Bearer Token**. Copy both.
The bearer token is shown once. If you misplace it, [rotate the token](#rotate-the-scim-token) to get a new one; the previous token keeps working until the grace period ends. If the token may have been exposed, [delete the configuration](#revoke-scim-access) instead, which revokes it immediately, and generate a new one.
A new SCIM configuration starts in **Full SCIM** mode. Confirm the **Provisioning Mode** value in the **SCIM Provisioning** section before you point your IdP at env zero.
Use the endpoint URL and bearer token in your IdP:
* [SCIM provisioning with Okta](/guides/sso-integrations/scim-provisioning-okta)
* [SCIM provisioning with Microsoft Entra ID](/guides/sso-integrations/scim-provisioning-entra-id)
For any other IdP that supports SCIM 2.0, point it at the same endpoint with the bearer token in the `Authorization` header. env zero publishes `/scim/v2/ServiceProviderConfig`, `/scim/v2/ResourceTypes`, and `/scim/v2/Schemas` for discovery. Filtering is supported; sorting, bulk operations, and ETags are not.
### Changing the provisioning mode
Select a different **Provisioning Mode** in the **SCIM Provisioning** section and confirm the dialog. Switching to **Full SCIM** shows the login-time SAML configuration that stops being applied, so you can see which admin group and team filter you are turning off.
## User attributes
env zero stores a subset of the SCIM core user schema:
| SCIM attribute | Stored as |
| :---------------------------------- | :-------------------------------------------------------------------------------- |
| `userName` | Email address, used to match the user. Required. |
| `externalId` | The IdP's user identifier, used for idempotent create and reactivation. Required. |
| `name.givenName`, `name.familyName` | First and last name |
| `name.formatted` or `displayName` | Display name |
| `active` | `false` deactivates the user |
Attributes env zero has nowhere to store, such as `title`, `phoneNumbers`, `addresses`, `roles`, and the Enterprise User extension, are accepted and ignored on both create and update. A stock IdP attribute mapping does not need to be trimmed.
A user created over SCIM is provisioned into the SCIM organization and every sub-organization mapped to it.
### Deactivation
`DELETE /scim/v2/Users/{id}` and an update with `active: false` remove the user from the SCIM organization and its sub-organizations. The underlying login is blocked only when no organization memberships remain, so deprovisioning a user from one organization never locks them out of another.
## Group to team mapping
Pushing a group to env zero creates an [env zero team](/guides/admin-guide/user-role-and-team-management/teams) with the group's display name and links the two. From then on, member changes in the IdP group are applied to the team.
* **Matching is by name.** Pushing a group whose display name matches an existing team returns HTTP 409 with `A group named already exists`. Rename the group in your IdP or rename the env zero team, then push again.
* **Renaming a group renames the team.** A rename to a name another team already uses returns the same 409.
* **Members must exist in env zero first.** Adding a member who is not provisioned into the organization or one of its sub-organizations returns HTTP 400. Assign the user to the application in your IdP so the user is provisioned before the group push carries them.
* **Removing a member removes their team membership**, and leaves the user account alone.
* **Unlinking or deleting the group removes the mapping only.** The env zero team and its members are preserved, and env zero does not recreate the mapping unless the IdP pushes the group again.
Permissions stay in env zero: assign [project roles](/guides/admin-guide/user-role-and-team-management/user-management#project-roles) to the team, and they survive membership changes from your IdP.
In **Full SCIM** mode the login-time team sync described in [Sync roles & groups from your IdP](/guides/sso-integrations/importing-roles-or-groups-from-your-identity-provider) no longer runs. Teams come from group pushes instead, so any group you relied on for team membership needs to be pushed over SCIM.
## Rotate the SCIM token
Rotation issues a new bearer token while the current one keeps working for a 24 hour grace period, so you can update your IdP without a provisioning outage.
In the **SCIM Provisioning** section, click **Rotate Token** and confirm.
The **SCIM Token Rotated** dialog shows the new bearer token and the expiry of the previous one. The new token is shown once.
Replace the token in your IdP's SCIM configuration and run its connection test. Until you do, provisioning continues on the old token.
**Old Token Expires At** in the **SCIM Provisioning** section shows how long the previous token stays valid. After that time, requests using it fail with HTTP 401.
## Reconcile users and teams
Reconcile compares your identity provider's SCIM data against env zero users and teams and reports drift. It is available in **Full SCIM** and **Hybrid (legacy)** modes.
Click **Reconcile** in the **SCIM Provisioning** section. The check is read-only and reports:
* **Users missing SCIM ownership** - organization members who signed in through SAML but are not marked as SCIM-owned, typically users who predate SCIM. Apply stamps SCIM ownership so later IdP updates and deactivations reach them.
* **Stale group mappings** - mappings whose env zero team no longer exists. Apply unlinks them.
* **Teams without SCIM mapping** - report only. Apply never creates, renames, or deletes teams.
To fix the reported drift, click **Apply Fixes** and confirm. The confirmation names the exact counts. Apply runs as a background job with progress, so you can close the page while it runs. A failed apply resumes from where it stopped on the next apply.
## Revoke SCIM access
Click **Delete Configuration** in the **SCIM Provisioning** section. This invalidates the token immediately and stops all SCIM provisioning from your IdP. Existing users, teams, and memberships are not deleted.
Deleting the configuration while the organization is in **Full SCIM** mode leaves login-time provisioning disabled. Change the [provisioning mode](#provisioning-modes) first if you want users provisioned at login again. Deleting also permanently removes **Hybrid (legacy)** eligibility; a new configuration cannot select that mode.
## Next steps
* [SCIM provisioning with Okta](/guides/sso-integrations/scim-provisioning-okta) - Configure the Okta SCIM connector and group push.
* [SCIM provisioning with Microsoft Entra ID](/guides/sso-integrations/scim-provisioning-entra-id) - Configure the Entra ID provisioning job.
* [Manage teams](/guides/admin-guide/user-role-and-team-management/teams) - Assign roles to the teams SCIM creates.
* [Manage users](/guides/admin-guide/user-role-and-team-management/user-management) - Review provisioned user accounts.