Your identity provider knows who works at your company. The fifty SaaS apps those people log into every day do not, unless you tell each one, every time, that something has changed. SCIM is how you stop having to tell them manually. It connects your identity provider to the applications where your users actually work and automatically creates, updates, and removes accounts as people join, change roles, or leave.
This guide covers what SCIM is, how SCIM integration works in practice, how it differs from SAML and SSO, and how to implement it without building a custom connector for every app. If you are building software that enterprises buy, SCIM support is increasingly the line between passing a security review and losing the deal. Ory's customer identity and access management stack treats provisioning as a first-class concern rather than an afterthought.
Key Takeaways
- SCIM automates the full user lifecycle. It creates accounts on day one and revokes them the moment someone leaves, replacing the ticket queue that quietly leaks access.
- De-provisioning is the security payoff. Orphaned accounts are live credentials nobody is watching. SCIM consistently closes that gap, whereas manual offboarding misses accounts for days.
- SCIM and SAML are not competitors. SCIM provisions the account so it exists; SAML authenticates the person at login. Most real deployments run both.
- It is a standard, not a per-app integration. RFCs 7642, 7643, and 7644 define a single REST contract, so any compliant IdP can talk to any compliant app without custom glue.
- Treat the SCIM token like a database credential. A leaked bearer token can create, modify, or delete users across your entire app ecosystem. Scope it, rotate it, monitor it.
What Is SCIM?
SCIM stands for System for Cross-domain Identity Management. It is an open standard that defines how user identity data is automatically exchanged between systems. Before SCIM, every application handled user data in its own way, which meant IT teams burned hours uploading CSVs, hand-writing API integrations, and re-keying the same names and emails into one platform after another.
The problem it solves is simple to state and miserable to manage by hand: organizations run many applications, and every application needs user accounts. SCIM provides identity providers and applications with a common language, enabling them to exchange user information without bespoke integration for each connection. If you have ever wired up single sign-on and then realized accounts still had to be created by hand first, SCIM is the missing half of that picture.
What Is SCIM Integration?
SCIM integration is the actual connection between an identity provider and the applications where users work. The identity provider serves as the source of truth for user data, and the integration automatically pushes that data to connected applications. Three components make it up:
- Identity provider (IdP): The central directory holding user data, such as Okta, Microsoft Entra ID, or Ory.
- Service provider (SP): The application receiving user data, like Slack, Salesforce, or a custom SaaS product.
- SCIM connector: The standardized REST API bridge that syncs data between the IdP and the SP.
When someone joins, their accounts appear in connected applications without anyone having to create them by hand. When someone leaves, those accounts disappear just as automatically. Ory's identity management and SCIM provisioning support both directions natively.
How SCIM Integration Works
Picture a new hire at a company running 50 SaaS applications. Without SCIM, an administrator opens each app, creates an account, enters the name and email, assigns permissions, and moves on to the next. Fifty times. With SCIM, the administrator adds the user once to the identity provider and every connected application receives that information automatically.
The technical flow follows a predictable pattern:
- An administrator adds a user to the identity provider directory.
- The SCIM client sends an HTTP request to each connected application's SCIM endpoint.
- Each service provider creates the account with the correct attributes and permissions.
- Future changes (role updates, department transfers, terminations) sync automatically.
SCIM uses standard REST methods—GET, POST, PUT, PATCH, and DELETE—to manage identity resources. That standardization is the whole point: any SCIM-compliant identity provider can talk to any SCIM-compliant application without anyone having to write custom integration logic. It is the same design philosophy behind Ory's Kratos identity APIs, where a clean REST contract does the heavy lifting.
- The BetterCloud State of SaaS Ops report highlights that the average enterprise now operates 106 SaaS applications.
- Organizations using manual processes spend an average of 500+ IT hours per year solely handling repetitive onboarding and access-granting requests - CloudEagle.ai
Core Components of SCIM
SCIM works because it standardizes a handful of building blocks that all implementations share. Knowing them helps when evaluating vendors or debugging a sync that has gone sideways.
SCIM Protocol and Specification
SCIM 2.0 is the current version, defined across RFCs 7642, 7643, and 7644. The specification spells out exactly how identity data travels: which HTTP methods to use, how to format requests and responses, and what each error code means. That level of detail is what makes interoperability across different vendors possible rather than aspirational.
SCIM Schema and Resources
SCIM defines two core resource types, Users and Groups, and each has a schema specifying its attributes. The standard User attributes include:
- userName: A unique identifier for the user.
- emails: The user's email addresses, which can include multiple entries.
- displayName: A human-readable name for interface display.
- active: A boolean for whether the account is enabled or disabled.
- groups: The group memberships assigned to the user.
You can extend these schemas with custom attributes when the standard set falls short. Ory's identity schema model takes the same extensible approach, letting you define the traits your application actually cares about.
SCIM Endpoints
Every SCIM implementation exposes a set of standard endpoints where operations happen:
| Endpoint | Purpose |
|---|
| /Users | Create, read, update, and delete user accounts |
| /Groups | Manage group memberships |
| /ServiceProviderConfig | Describes the provider's SCIM capabilities |
| /Schemas | Returns the supported schema definitions |
SCIM Tokens and Authentication
SCIM authenticates requests between identity providers and service providers with bearer tokens, which in practice are usually OAuth 2.0 access tokens. Every call carries the token in the Authorization header, and the receiving system validates it before doing anything.
Token security is not optional here. A compromised SCIM token lets an attacker create, modify, or delete user accounts across an entire application ecosystem. Treat these tokens with the same paranoia you reserve for database credentials: scope them tightly, rotate them, and watch them.
What Is SCIM Provisioning and De-Provisioning?
Provisioning and de-provisioning are the two directions of user lifecycle management, and they are where SCIM earns its keep.
- Provisioning: When a user joins or gains access to a new application, SCIM creates their account with the right attributes and permissions. No ticket, no manual entry.
- De-provisioning: When someone leaves or changes roles, SCIM disables or removes their access across every connected platform. No orphaned accounts left holding active credentials.
The de-provisioning side usually matters more from a security standpoint. Former employees who keep access to company systems are a real and recurring risk, and manual offboarding routinely misses accounts or takes days. SCIM makes revocation immediate and consistent, which is exactly the property auditors and security teams want to see.
Why SCIM Integration Matters
The average enterprise runs a large and growing pile of SaaS applications, and each one needs accounts. Every account is a potential security risk if it is not managed cleanly across its whole lifecycle.
Without SCIM, IT faces a scaling problem it cannot win. Create accounts when people join, update them when roles change, remove them when people leave—by hand, forever. That model breaks as the organization grows, and the gaps it leaves become vulnerabilities. SCIM turns identity management from a reactive, ticket-driven scramble into an automated, policy-driven system, the same shift Ory pushes for across identity and access management. When HR records a termination, every connected app knows within seconds, not days.
Benefits of SCIM Integration
Faster User Onboarding and Offboarding
New hires get access to all required applications on day one instead of waiting in an access request queue. Departing employees lose access the moment they leave, not whenever someone remembers to process the termination.
Reduced Administrative Overhead and Human Error
Killing manual data entry means fewer typo'd email addresses, fewer misconfigured permissions, and fewer hours lost to repetitive provisioning. IT gets to spend its time on work that actually needs human judgment.
Stronger Security and Access Control
Orphaned accounts are credentials that stay live after someone leaves. They are a favorite attack vector precisely because they are forgotten and unmonitored. SCIM's automated deprovisioning closes that door consistently and immediately across all connected apps. Pair it with zero trust API security patterns and you remove a whole class of standing access.
Easier Compliance and Audit Readiness
SCIM produces a centralized audit trail of who had access to what and when it changed. That makes compliance reporting for SOC 2, GDPR, and HIPAA far less painful, since demonstrating access control is a core requirement in all three.
See how Ory handles SCIM provisioning
Common Use Cases for SCIM Integration
B2B SaaS and Enterprise Applications
If you build SaaS for enterprise customers, SCIM support is often a hard requirement for closing deals. Enterprise IT expects to provision users from their existing identity provider, not manage accounts by hand in your app. Without it, your product may not survive a security review. Building the SCIM server side is exactly the kind of thing Ory Kratos is designed to handle.
Workforce Identity Lifecycle Management
HR-driven events trigger provisioning automatically. Hire someone; their accounts appear. Move them from Engineering to Sales; their application access updates to match. Terminate them, and access vanishes everywhere at once.
Identity Governance and Continuous Access Verification
SCIM fits naturally into architectures where access is continuously verified and revoked the moment it is no longer appropriate. The protocol keeps users with only the access they currently need, with changes propagating in real time rather than waiting for a nightly sync. For the access-decision layer that complements provisioning, see Ory's fine-grained authorization with Keto.
SCIM vs. SAML
SCIM and SAML solve different problems and usually work together rather than replacing each other.
| Aspect | SCIM | SAML |
|---|
| Purpose | User provisioning and lifecycle management | Authentication and single sign-on |
| Function | Creates, updates, and deletes accounts | Verifies identity at login time |
| When used | Ongoing account synchronization | Each login event |
SAML handles authentication: proving you are who you claim when you log in. SCIM handles provisioning: making sure the account exists at all. You typically run both. SCIM creates the account; SAML authenticates the user against it. If you want the deeper SAML picture, Ory's primer on SAML SSO from the user side is a good starting point.
SCIM vs. SSO
Single sign-on lets users authenticate once and reach multiple applications with that single login. But SSO does not create accounts. It assumes they already exist.
- SSO: Handles authentication with one credential set across connected apps. Does not create or remove accounts.
- SCIM: Handles provisioning and de-provisioning. Creates and manages the user profiles SSO needs something to authenticate against.
Without SCIM, IT still has to create accounts manually before SSO can do anything. With SCIM, the whole lifecycle, from account creation through authentication to eventual removal, is automated. For how these pieces assemble, see Ory's breakdown of SSO building blocks and the wider take on SCIM and directory sync.
How to Implement SCIM Integration
- Assess Identity and Provisioning Requirements: Identify which applications require SCIM integration and which user attributes need to be synced. Map your lifecycle events—hiring, transfers, and terminations—so you know what triggers a provisioning change and what data rides along with each one.
- Choose a SCIM Provider or Build a SCIM Server: Use an identity provider with built-in SCIM support, or build a custom SCIM server if you are the SaaS product that enterprise customers will connect to. The choice comes down to whether you are consuming SCIM as an application or providing it as an identity source. Ory's open-source identity components cover both, with deployment flexibility across self-hosted and managed environments, helping teams avoid vendor lock-in.
- Configure Endpoints and Authentication: Set up the SCIM endpoints in the service provider, configure OAuth 2.0 bearer token authentication, and secure every connection with HTTPS. The exact steps vary by vendor, but the concepts hold across implementations. Ory's Kratos configuration reference walks through the relevant settings.
- Monitor and Maintain the Integration: Provisioning failures happen. API timeouts, schema mismatches, and rate limits all interrupt sync. Set up monitoring and alerting to catch failures before they become security gaps or broken user experiences.
Frequently Asked Questions About SCIM Integration
Is SCIM Integration Secure?
Yes. SCIM uses HTTPS for transport encryption and OAuth 2.0 bearer tokens for authentication, so only authorized systems can read or modify identity data. The real security of any deployment comes down to token management and endpoint configuration.
Does SCIM Support Group Provisioning?
Yes. SCIM 2.0 includes a Groups resource type for provisioning and managing group memberships alongside individual accounts. That is what enables role-based access control, in which group membership determines application permissions.
Which Identity Providers Support SCIM?
Major providers including Okta, Microsoft Entra ID, Google Workspace, OneLogin, and Ory support SCIM for outbound provisioning to connected applications. Most enterprise-grade identity platforms ship it as a standard feature.
Running SCIM Provisioning at Scale With Ory
Ory provides customer identity and access management with SCIM provisioning, single sign-on, and fine-grained authorization in one stack. Ory Kratos manages identities and SCIM sync; Ory Hydra handles the OAuth 2.0 tokens that authenticate SCIM calls; and Ory Keto decides what each provisioned user is actually allowed to do.
It is open source at its core, with deployment across self-hosted, managed, and hybrid configurations, so provisioning scales with your application footprint rather than becoming a bottleneck.
SCIM is not glamorous, but it is the difference between identity management that scales and a manual process that quietly leaks access every time someone changes jobs. Provision automatically, de-provision the instant someone leaves, treat your SCIM tokens like the high-value credentials they are, and wire authentication and authorization in alongside it. The teams that get provisioning right early stop thinking about it. The teams that defer it spend the next two years chasing orphaned accounts.
Explore Ory's CIAM and SCIM provisioning
