Business sign-on and provisioning Recommended

Provision users with SCIM

Offer SCIM 2.0, as RFC 7643 and RFC 7644 define it, so a customer's directory creates, updates and removes users and groups.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Serve /Users, /Groups, /ServiceProviderConfig, /ResourceTypes and /Schemas under one base address per organisation. Give each organisation its own bearer token, shown once and stored as a hash. Support filter=userName eq "…", PATCH and paging, because directories such as Okta and Microsoft Entra ID use them. Store the directory's externalId next to your user ID. Treat active set to false like a removal. Return errors in the SCIM error format.

Example

PATCH /scim/v2/Users/2819c223 HTTP/1.1
Host: example.com
Authorization: Bearer scim_live_…
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{ "op": "replace", "path": "active", "value": false }]
}

How to check

Run a SCIM test suite, such as the one Okta or Microsoft Entra ID provides, against staging. Every test passes. A user created through SCIM can sign in.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/scim-provisioning.