---
title: "Provision users with SCIM · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/scim-provisioning
updated: 2026-10-20
licence: "All rights reserved"
---

# Provision users with SCIM

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)
- Rule: Offer SCIM 2.0, as RFC 7643 and RFC 7644 define it, so a customer's directory creates, updates and removes users and groups.
- How: Serve `/Users`, `/Groups`, `/ServiceProviderConfig`, `/ResourceTypes` and `/Schemas` under one base address per organisation. Give each organisation its own bearer token, shown once and stored as a hash. Support `filter=userName eq "…"`, `PATCH` and paging, because directories such as Okta and Microsoft Entra ID use them. Store the directory's `externalId` next to your user ID. Treat `active` set to false like a removal. Return errors in the SCIM error format.
- Check: Run a SCIM test suite, such as the one Okta or Microsoft Entra ID provides, against staging. Every test passes. A user created through SCIM can sign in.

Example:

```http
PATCH /scim/v2/Users/2819c223 HTTP/1.1
Host: example.com
Authorization: Bearer scim_live_…
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{ "op": "replace", "path": "active", "value": false }]
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/scim-provisioning`.

- Previous: [Let organisations require single sign-on](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/require-sso)
- Next: [Remove access at once when the directory says so](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/deprovision)
- [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning)