Provisioning automatically creates user accounts. Deprovisioning removes user accounts when no longer needed.
Provision SCIM In OWN
Master Admin users and Security Admin users can create or revoke tokens, enabling and disabling SCIM provisioning.
SCIM integration is supported if you're using the Identification Provider (IdP) from Okta, Azure, or SailPoint.
SCIM is available for accounts where SSO is both configured and activated.
- In Manage go to Security, then navigate to the SCIM Provisioning section.
-
Click Generate. The Generate SCIM Token panel appears displaying the SCIM Token and the
SCIM URL. A confirmation email, New SCIM Token, is sent.
Treat your SCIM token and SCIM URL as securely as any other type of password. Make sure to store them in a safe and secure location.
-
Integrate the IdP with Own application using the SCIM token and SCIM URL. The following
are high level overviews for setting up SCIM provisioning with IdPs:
- For integrating using Okta as the IdP, see Set Up Okta SCIM Provisioning
- For integrating using Azure as the IdP, see Set Up Azure SCIM Provisioning
- For integrating using SailPoint as the IdP, see Set Up SailPoint SCIM Provisioning
- A New SSO account with Own confirmation email is sent to the user assigned as a new user in step 3. The email instructs the new user to sign in using the IdP for SSO. This IdP is separate from the SCIM IdP.
Revoke SCIM Token in Own
Revoking the SCIM Token in Own application, stops access to the SCIM API, disabling the integration with the IdP and stopping SCIM user management. To regain access generate a new SCIM Token. Make sure to update the IdP.
- In the SCIM Provisioning section click the three dots and select Revoke.
- Confirm the action in the Revoke SCIM token? popup. A confirmation email, SCIM Token Revoked, is sent.
SCIM Deprovisioning through the IdP
When deprovisioning is done through the IdP, the SCIM API synchronizes the changes with Own application. Deprovisioning is through the IdP and removes user access to the Own Application. This ensures inactive users no longer have access, reducing security risks. The User status will be “Disabled”.
Removing a User via UI: As SCIM integration requires synchronization between your IdP and Own application, avoid manual changes in the Own application while SCIM is enabled. If manual updates are made in the UI, for example adding a new user or disabling/deleting an existing user, update the IdP to maintain alignment. The user remains in the IdP but loses access to Own application.