---
schema_version: "1"
id: f21cb3341d20985078672ea0b04447a56f4feac486885c3e969865833439a382
title: SCIM
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/online/scim_config_online.md
canonical_url: https://help.tableau.com/v0.0/online/en-us/scim_config_online.htm
source_site: help.tableau.com
content_type: documentation
content_hash: e95a6ffbb3603016280e0b135982d469dad48f1ecbf0388432756504dbdd0264
description: Configure SCIM provisioning of users and groups for Tableau Cloud.
---
[Skip to main content](#main-content)

# SCIM

System for Cross-domain Identity Management (SCIM) is a protocol that standardizes the automation of users and groups provisioning for cloud-based applications like Tableau Cloud. Tableau Cloud supports SCIM, enabling identity providers (IdPs) to centrally manage user identities while streamlining the process of managing users and group membership in Tableau Cloud. The IdP uses SCIM to ensure that access is granted and revoked in a timely way and Tableau Cloud is kept in sync with the provisioning assignments in the IdP. This type of integration improves security and reduces the manual work for site administrators in Tableau Cloud.

![A straightforward illustration of the identity provider linking to SCIM and Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/scim_provisioning.jpg)

In the diagram above, the IdP _pushes_ updates to Tableau Cloud and controls how often Tableau Cloud’s SCIM endpoints are called to ensure users and groups are appropriately mirrored.

## IdP-specific configuration

The steps later in this topic provide general information that you can use with your IdP’s documentation to configure SCIM for your Tableau Cloud site. You can get IdP-specific configuration steps for the following IdPs we support:

- [Configure SCIM with Microsoft Entra ID](https://help.tableau.com/v0.0/online/en-us/scim_config_azure_ad.htm)
- [Configure SCIM with Okta](https://help.tableau.com/v0.0/online/en-us/scim_config_okta.htm)
- [Configure SCIM with OneLogin](https://help.tableau.com/v0.0/online/en-us/scim_config_onelogin.htm)
- [Configure SCIM with PingFederate](https://help.tableau.com/v0.0/online/en-us/scim_config_pingfederate.htm)

## Overview of enabling SCIM support

Review the following steps to enable SCIM integration in Tableau Cloud and your IdP. To complete this process, you’ll also need the documentation your IdP provides. Look for topics that refer to configuring or enabling a service provider for SCIM provisioning.

**Notes:**

- After enabling SCIM, users and their attributes should be managed through the IdP. Changes made within Tableau Cloud directly may result in unexpected behavior and overwritten values.
- Beginning in January 2025 (Tableau 2024.3):
    
    - You can choose the SAML authentication configuration to associate with SCIM. However, only one SAML authentication configuration can support SCIM on a site.
    - The SCIM capability is no longer site admin-scoped. In other words, all site administrators have the ability to configure and edit SCIM.
- Beginning in June 2025 (Tableau 2025.2):
    
    - You can configure one or more SCIM configurations on a site.
    - You can bypass the SCIM token that Tableau generates and instead use an externally generated JWT (using a Tableau connected app) to support SCIM requests in Tableau Cloud.
- Beginning in December 2025, you can automate users and groups provisioning by using the [Tableau SCIM API](https://help.tableau.com/current/api/scim-api/en-us/index.html).
- Beginning in February 2026 (Tableau 2026.1), you can choose OIDC and Google authentication to associate with SCIM.
- Beginning in June 2026 (Tableau 2026.2), [custom domains](https://help.tableau.com/current/online/en-us/custom_domain.htm) are supported with SCIM integration.

### Step 1: Perform prerequisites

Before enabling SCIM integration with your Tableau Cloud site, you’ll need to meet the following requirements:

- Have site administrator access to the Tableau Cloud site.
- Able to modify your IdP's settings for Tableau Cloud.
- Your site is already configured to support SAML or OIDC (or Google) single sign-on (SSO). If you haven’t done this, see [Enable SAML Authentication on a Site or TCM](https://help.tableau.com/v0.0/online/en-us/saml_config_site.htm) or [Configure Tableau Cloud or TCM for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm), and then follow your IdP’s documentation to add Tableau Cloud as an application.
- Optionally, if using external token generation and management, you have the following:
    
    1. Created and enabled a Tableau connected app. If you haven't done this, see [Use Tableau Connected Apps for Application Integration](https://help.tableau.com/v0.0/online/en-us/connected_apps.htm).
    2. A valid JWT that contains the following scopes: `tableau:users:*` and `tableau:groups:*`

### Step 2: Enable SCIM support

#### In Tableau Cloud - using a Tableau-generated token

1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication.
2. Do the following:
    
    1. On the Authentication page, under System for Cross-domain Identity Management (SCIM), click the **New Configuration** button.
    2. In the New SCIM Configuration dialog box, do the following:
        
        1. Enter a name for the SCIM configuration.
        2. Copy the Base URL to use in your IdP's SCIM settings.
        3. From the Authentication drop-down, select the authentication configuration to associate with SCIM.
        4. Click **Save**.
            
            **Note:** This populates the SCIM token section.
            
            ![A new SCIM configuration](/tableau/next/en-us/online/en-us/Img/scim_config_new.png)
    3. Under SCIM token, do the following:
        
        1. Click the New Secret button.
        2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display.
            
            ![](/tableau/next/en-us/online/en-us/Img/scim_config_newsecret_newsecret.png)
        3. Copy the secret and store it in a safe location.
            
            **Important:**
            
            - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret.
            - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings.
            
            ![](/tableau/next/en-us/online/en-us/Img/scim_config_secret.png)
        4. Click **Close**.
3. Navigate to your IdP's SCIM settings and paste the Tableau Cloud base URL and SCIM token in the appropriate fields.

#### In Tableau Cloud, using an external token

1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication.
2. Do the following:
    
    1. Under System for Cross-domain Identity Management (SCIM), click the New Configuration button.
    2. In the New SCIM Configuration dialog box, do the following:
        
        1. Enter a name for the SCIM configuration.
        2. Copy the Base URL to use in your IdP's SCIM settings.
        3. From the Authentication drop-down, select the authentication configuration to associate with SCIM.
        4. Click Save.
            
            **Note:** This populates the SCIM token section, which you can safely ignore.
        5. When finished, click Close.
3. Navigate to your IdP's SCIM settings and paste the Tableau Cloud base URL in the appropriate field.

#### In the IdP

After meeting the prerequisites and enabling SCIM in Tableau Cloud, use the steps in your IdP's documentation to enable SCIM support with your identity provider (IdP). For some general guidance for specific IdPs, see [IdP-specific configuration](#idp_specific).

### Step 3: Provision users and groups

Follow your IdP’s documentation to provision users and groups after enabling SCIM support. For some general guidance for specific IdPs, see [IdP-specific configuration](#idp_specific).

You can also automate users and groups provisioning by using the [Tableau SCIM API](https://help.tableau.com/current/api/scim-api/en-us/index.html).

#### Supported user attributes

When you provision users and groups through SCIM, Tableau Cloud honors a set of attributes sent by the IdP. Other attributes sent by the IdP are ignored and not stored or updated in Tableau.

 
| SCIM action | Attributes honored by Tableau |
| --- | --- |
| Create user | `userName`, `siteRoles` |
| Update user | `siteRoles`, `active` (true or false) |
| Create group | `displayName` |
| Update Group | `displayName`, `members`, `minimumSiteRole` |

**Notes:** 

- On Tableau Cloud, `userName` attribute is the email address. However, the `emails` attribute is not supported and therefore ignored.
- If `siteRoles` is not included, the user will be created with the _Viewer_ site role in Tableau.

## Replace a Tableau-generated SCIM token

When you need to replace your Tableau-generated SCIM token, follow the steps below to generate a new secret for the existing SCIM configuration.

**Note:** To generate a new token for an existing SCIM configuration, you must be the site administrator who created the SCIM configuration.

1. In Tableau Cloud, navigate to Settings > Authentication.
2. Under System for Cross-domain Identity Management (SCIM), next to the SCIM configuration, select **Actions** > **Edit Configuration**.
3. Under SCIM token, do the following:
    
    1. Click the New Secret button.
    2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display.
    3. Copy the secret and store it in a safe location.
        
        **Important:**
        
        - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret.
        - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings.

## Other articles in this section