🪪 SCIM 2.0
System for Cross-domain Identity Management — standardized identity API (RFC 7644). Works for Okta, Azure SCIM-enabled apps, etc.
Identification
- vendor key:
scim - engine:
scim - default role:
bidirectional - type: Generic protocol
- vendor docs: https://datatracker.ietf.org/doc/html/rfc7644
Supported auth methods
bearerbasicoauth2_client_credentials
Importable objects (2)
Object types the wizard offers to import out of the box.
Users
- name:
users - iga_target:
identity - path:
/Users
SCIM Users resource.
Default field mappings:
| IGA field | Expression | Required |
|---|---|---|
business_id |
{{ id }} |
✓ |
identity_id |
{{ userName }} |
✓ |
email |
{{ emails[0].value }} |
|
first_name |
{{ name.givenName }} |
|
last_name |
{{ name.familyName }} |
|
display_name |
{{ displayName }} |
|
employee_id |
{{ externalId }} |
|
native_account_name |
{{ userName }} |
✓ |
identity_business_id |
{{ externalId|if_null(userName)|lower }} |
|
status |
{{ 'active' if active else 'suspended' }} |
|
is_privileged |
{{ false }} |
Groups
- name:
groups - iga_target:
entitlement - path:
/Groups
SCIM Groups resource.
Default field mappings:
| IGA field | Expression | Required |
|---|---|---|
business_id |
{{ id }} |
✓ |
name |
{{ displayName }} |
✓ |
description |
{{ externalId|if_null('') }} |
|
native_identifier |
{{ id }} |
|
risk_level |
'low' |
Onboarding setup checklist
Enable SCIM 2.0 in the target system and retrieve the bearer token + endpoint URL. Most SaaS providers have a 'SCIM 2.0 Provisioning' feature in their admin settings.
Estimated time: ~10 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.