---
schema_version: "1"
id: bf6309a1cd7be67ce60a192a0a90584d4172a59d0975608a180ca0486e1d6fc9
title: Provisioning and Deprovisioning SCIM
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/platform_o_scim_provisioning.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.platform_o_scim_provisioning.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c11026c69187e2607011b33d01cb315fd9058a98e401af5589dcd9df64bb53d6
description: Provisioning automatically creates user accounts. Deprovisioning removes user accounts when no longer needed.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Provisioning and Deprovisioning SCIM

Provisioning automatically creates user accounts. Deprovisioning removes user accounts when no longer needed.

## Provision SCIM In OWN

Master Admin users and Security Admin users can create or revoke tokens, enabling and disabling SCIM provisioning.

SCIM integration is supported if you're using the Identification Provider (IdP) from Okta, Azure, or SailPoint.

SCIM is available for accounts where SSO is both configured and activated.

1. In Manage go to Security, then navigate to the SCIM Provisioning section.
2. Click Generate. The Generate SCIM Token panel appears displaying the SCIM Token and the SCIM URL. A confirmation email, New SCIM Token, is sent.
    
    Treat your SCIM token and SCIM URL as securely as any other type of password. Make sure to store them in a safe and secure location.
3. Integrate the IdP with Own application using the SCIM token and SCIM URL. The following are high level overviews for setting up SCIM provisioning with IdPs:
    
    - For integrating using Okta as the IdP, see [Set Up Okta SCIM Provisioning](https://help.salesforce.com/s/articleView?id=platform.platform_o_scim_okta_provisioning.htm&release=264.0.0&type=5 "Integrate Okta with Own application using the SCIM token and SCIM URL.")
    - For integrating using Azure as the IdP, see [Set Up Azure SCIM Provisioning](https://help.salesforce.com/s/articleView?id=platform.platform_o_scim_azure_provisioning.htm&release=264.0.0&type=5 "Integrate Azure with Own application using the SCIM token and SCIM URL.")
    - For integrating using SailPoint as the IdP, see [Set Up SailPoint SCIM Provisioning](https://help.salesforce.com/s/articleView?id=platform.platform_o_scim_sailpoint_provisioning.htm&release=264.0.0&type=5 "Integrate SailPoint with the Own Data Platform application using the SCIM token and SCIM URL.")
4. A New SSO account with Own confirmation email is sent to the user assigned as a new user in step 3. The email instructs the new user to sign in using the IdP for SSO. This IdP is separate from the SCIM IdP.

## Revoke SCIM Token in Own

Revoking the SCIM Token in Own application, stops access to the SCIM API, disabling the integration with the IdP and stopping SCIM user management. To regain access generate a new SCIM Token. Make sure to update the IdP.

1. In the SCIM Provisioning section click the three dots and select Revoke.
2. Confirm the action in the Revoke SCIM token? popup. A confirmation email, SCIM Token Revoked, is sent.

## SCIM Deprovisioning through the IdP

When deprovisioning is done through the IdP, the SCIM API synchronizes the changes with Own application. Deprovisioning is through the IdP and removes user access to the Own Application. This ensures inactive users no longer have access, reducing security risks. The User status will be “Disabled”.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_note.png)

Note IdPs may use their own terminology for Deprovisioning. For example, Okta calls it Deactivating.

Removing a User via UI: As SCIM integration requires synchronization between your IdP and Own application, avoid manual changes in the Own application while SCIM is enabled. If manual updates are made in the UI, for example adding a new user or disabling/deleting an existing user, update the IdP to maintain alignment. The user remains in the IdP but loses access to Own application.

Removing a User via IdP: The user is deleted from the Users tab UI, and is removed from associated regions.