🪪 SCIM 2.0

System for Cross-domain Identity Management — standardized identity API (RFC 7644). Works for Okta, Azure SCIM-enabled apps, etc.

Identification

• vendor key: scim
• engine: scim
• default role: bidirectional
• type: Generic protocol
• vendor docs: https://datatracker.ietf.org/doc/html/rfc7644

Supported auth methods

• bearer
• basic
• oauth2_client_credentials

Importable objects (2)

Object types the wizard offers to import out of the box.

Users

• name: users
• iga_target: identity
• path: /Users

SCIM Users resource.

Default field mappings:

IGA field	Expression	Required
business_id	{{ id }}	✓
identity_id	{{ userName }}	✓
email	{{ emails[0].value }}
first_name	{{ name.givenName }}
last_name	{{ name.familyName }}
display_name	{{ displayName }}
employee_id	{{ externalId }}
native_account_name	{{ userName }}	✓
identity_business_id	{{ externalId|if_null(userName)|lower }}
status	{{ 'active' if active else 'suspended' }}
is_privileged	{{ false }}

Groups

• name: groups
• iga_target: entitlement
• path: /Groups

SCIM Groups resource.

Default field mappings:

IGA field	Expression	Required
business_id	{{ id }}	✓
name	{{ displayName }}	✓
description	{{ externalId|if_null('') }}
native_identifier	{{ id }}
risk_level	'low'

Onboarding setup checklist

Enable SCIM 2.0 in the target system and retrieve the bearer token + endpoint URL. Most SaaS providers have a 'SCIM 2.0 Provisioning' feature in their admin settings.

Estimated time: ~10 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.