← All documentation

SCIM provisioning

SCIM provisioning is included in Premium and Enterprise. It is not on the
Free plan.

Settings → SCIM lets your identity provider create, update and deactivate your members automatically. Only an organization admin can change it.

Setting it up

  1. Turn on SCIM. The page shows the SCIM Base URL and a Bearer Token; the token is shown once, so copy it then.
  2. Enter both in your identity provider's provisioning settings (the page has steps for Okta, Microsoft Entra ID, Google Workspace and OneLogin).
  3. Assign people or groups to the application at your provider. Their accounts appear in your organization as they sync, and Recent provisioning activity confirms it.

What a sync does

  • A new person becomes a member.
  • A deactivated person is suspended, not deleted: they can no longer sign in, their API keys and AI assistant connections stop working, and the seat is freed. Turning them back on at your provider restores the membership.
  • SCIM sees and changes only your organization's members. Platform staff accounts are never listed.

Regenerating the token stops the old one at once; update your provider with the new one.