SCIM provisioning

SCIM 2.0 lets an enterprise customer's identity provider push user and group changes into your tenant automatically. When somebody joins, their account is created; when they leave, it is deactivated — without anyone filing a ticket.

SCIM is included in every plan. There is no per-connection fee.

Before you start

SCIM complements enterprise SSO rather than replacing it. SSO decides who may sign in right now; SCIM keeps the user list itself in step with the customer's directory. Most customers who ask for one end up wanting both.

You will need an app in the tenant that the identity provider can use as its credential. SCIM is authenticated with a client_credentials access token, so the app must be confidential.

Enable SCIM on an app

1. Go to Apps → (select app) → SCIM.
2. Pick the provider you are integrating with — Azure Entra ID, Okta or Custom. This sets the default attribute mapping.
3. Turn on the four SCIM scopes. The app needs all of them: scim:users:read, scim:users:write, scim:groups:read, scim:groups:write.
4. Adjust the attribute mapping if the customer's directory sends something non-standard.

The base URL and token endpoint to hand to the customer are shown under Tenants → (select tenant) → SCIM:

https://{tenant-id}.authalla.com/scim/v2
https://{tenant-id}.authalla.com/oauth2/token

On a custom domain, both use that domain instead.

Authentication

The identity provider exchanges the app's client credentials for a bearer token and sends it on every SCIM request:

curl -X POST https://{tenant-id}.authalla.com/oauth2/token \
  -d grant_type=client_credentials \
  -d client_id={client-id} \
  -d client_secret={client-secret} \
  -d scope="scim:users:read scim:users:write scim:groups:read scim:groups:write"

curl https://{tenant-id}.authalla.com/scim/v2/Users \
  -H "Authorization: Bearer {access-token}" \
  -H "Content-Type: application/scim+json"

Authalla accepts both application/scim+json and application/json on requests with a body.

The three discovery endpoints — /ServiceProviderConfig, /ResourceTypes and /Schemas — are public and need no token, which is what most identity providers probe first.

Endpoints

What is supported

GET /scim/v2/ServiceProviderConfig is the authoritative answer, and it reports:

changePassword is not a gap — there is no password anywhere in Authalla, so there is nothing for the directory to reset. Users sign in with passkeys or magic links regardless of how their account was created.

Filtering

Filtering supports the eq operator only, on these attributes:

• Users — userName, emails.value
• Groups — displayName, externalId

GET /scim/v2/Users?filter=userName eq "ada@example.com"

Any other operator or attribute returns an error. externalId is not filterable on users, only on groups — Azure Entra ID and Okta both provision fine without it, but a custom integration that relies on it will need changing.

Attribute mapping

The provider preset you chose sets the defaults. Each field names the SCIM attribute Authalla reads it from:

Override any of them under Apps → (select app) → SCIM when the customer's directory sends a different shape. Groups map displayName and externalId the same way.

Troubleshooting

The identity provider reports 401 on every request. Check that all four SCIM scopes are enabled on the app. A token missing one of them is rejected on the endpoints that need it, and some providers surface that as a blanket authentication failure.

Users are created but never deactivated. Most directories send a PATCH setting active to false rather than a DELETE. Confirm the app holds scim:users:write.

A filter returns an error. Only eq is supported, and only on the attributes listed above. Check what the provider is actually sending — a directory configured to filter on externalId for users will fail.