SCIM User Provisioning lets your identity provider, such as Okta or Microsoft Entra ID, create, update, suspend and remove IntelligenceBank user accounts automatically.
Beta: SCIM User Provisioning is currently in BETA. Its capabilities, and the details in this article, may change before general release.
Table of Contents
What SCIM Provisioning Does
SCIM (System for Cross-domain Identity Management) is the standard way an identity provider manages user accounts in the apps your staff use. Single Sign On decides how someone logs in. SCIM decides whether they have an account at all, and keeps that account in step with your identity provider.
With SCIM provisioning in place:
- New starters get an IntelligenceBank account automatically, before their first login.
- Profile changes such as name, job title or department are sent to IntelligenceBank as they change in your identity provider.
- Suspending a user in your identity provider suspends them in IntelligenceBank.
- Leavers are suspended or removed automatically, depending on how your identity provider is set up. Their history is kept.
SCIM provisioning compared with just-in-time provisioning
IntelligenceBank also supports just-in-time provisioning, which creates a user the first time they log in through SAML Single Sign On. The table below shows how the two differ.
| Just-in-time provisioning | SCIM provisioning | |
|---|---|---|
| When the account is created | The first time the user logs in through SSO. | As soon as the user is assigned in your identity provider, before they log in. |
| Profile updates | Only when the user next logs in. | Sent by your identity provider when the details change. Note that the speed is determined by your Provider. |
| Removing access | Must be done manually in IntelligenceBank. | Suspending or removing the user in your identity provider is reflected in IntelligenceBank automatically. |
| Default group and division | Taken from the template user, unless your identity provider sends a division. | Groups come from the template user. Division comes from your identity provider if it sends one, and from the template user otherwise. |
Requirements
- SCIM User Provisioning enabled for your IntelligenceBank platform. IntelligenceBank enables this for you on request.
- An identity provider that supports SCIM 2.0 provisioning with OAuth 2.0 client credentials, such as Okta or Microsoft Entra ID, and an administrator who can configure it.
- A template user configured on your platform. New SCIM users take their default group and status from it. They also take its division, unless your identity provider sends one. See Enabling auto-creation / just-in-time provisioning of SAML users.
- SCIM is typically used alongside SAML Single Sign On, which handles how users log in.
Getting Started
There is no self-service setup screen during the beta. IntelligenceBank enables SCIM for your platform and issues your connection credentials. Follow the steps below.
| 1Request Access | Contact IntelligenceBank Support and ask for SCIM User Provisioning (BETA) to be enabled on your platform. |
| 2Receive Credentials | IntelligenceBank sends you the connection credentials for your platform: a client ID, a client secret and a token URL. Store the client secret securely. |
| 3Check the Template User | Confirm your template user has the default group and division that new users should receive. See Enabling auto-creation / just-in-time provisioning of SAML users. |
| 4Configure Your Identity Provider | In your identity provider, set up SCIM 2.0 provisioning as a custom application for IntelligenceBank, using the connection details below. |
| 5Map Attributes | Map your identity provider's user attributes to the SCIM attributes listed in Attribute Mapping. userName must be the user's email address. |
| 6Assign Users and Test | Assign a small number of test users to the connection first. Confirm they appear in Admin > Users in IntelligenceBank with the expected details before assigning everyone. |
Connection details
| SCIM base URL | https://<your platform host>/scim/v2Replace <your platform host> with the address you use to reach your IntelligenceBank platform. |
| Authentication | OAuth 2.0 client credentials. |
| Token endpoint | The token URL provided with your credentials. |
| Client ID | Provided by IntelligenceBank. |
| Client secret | Provided by IntelligenceBank. |
Note: Your credentials only work for SCIM, and only for your own platform. They cannot be used to call any other part of the IntelligenceBank API.
Attribute Mapping
IntelligenceBank accepts the following SCIM user attributes. Only userName is required.
| SCIM attribute | Description | Required |
|---|---|---|
| userName | The user's email address. This is the user's IntelligenceBank login. | Yes |
| name (givenName, familyName) | The user's first and last name. | Optional |
| title | Job title. | Optional |
| phoneNumbers | Phone number. | Optional |
| timezone | The user's time zone. | Optional |
| locale | The user's language. | Optional |
| addresses | The user's address. | Optional |
| active | Whether the user is active. Set to false to suspend the user. | Optional |
| externalId | Your identity provider's own identifier for the user. Stored in the user's External ID field. | Optional |
| Enterprise extension: costCenter | Cost center. | Optional |
| Enterprise extension: organization | Organization. | Optional |
| Enterprise extension: department | Department. | Optional |
| Enterprise extension: division | The user's Division, matched by name to an existing Division on your platform. If no Division has that name, the user is not created. If not sent, the template user's Division applies. | Optional |
| Enterprise extension: manager | The user's manager. | Optional |
Note: New users get their groups from the template user. Their Division comes from the division attribute when your identity provider sends one, and from the template user otherwise. Groups sync is not available in the beta.
What Happens When
| A user is assigned | IntelligenceBank creates the user with the details your identity provider sends. The user takes their default group, division and status from the template user. If the email address already exists on your platform, or the division sent doesn’t match a Division on your platform, the user is not created. See Limitations in the Beta. |
| A user's details change | IntelligenceBank updates the user's profile to match. |
| A user is suspended | When your identity provider sets the user to inactive, IntelligenceBank suspends them. Their access to the IntelligenceBank platform is revoked, and their history is kept. Reactivating them in your identity provider makes them active again. |
| A user is unassigned | Most identity providers suspend the user rather than deleting them. Check your identity provider’s settings to see what it does. |
| A user is deleted | The user is removed from the platform. Their record and history are kept for auditing, and they appear under the Deleted status filter in Admin > Users. |
| A deleted user is added again | IntelligenceBank refuses the request. An administrator restores the user in IntelligenceBank first, as for any deleted user: by adding the user again, or by changing the deleted user's status. Your identity provider can then manage them again. |
Security
- Authentication uses OAuth 2.0 client credentials. Access tokens expire after 15 minutes by default.
- Credentials are issued per platform. A credential issued for another platform is refused.
- SCIM credentials can only be used for SCIM, and other API credentials cannot be used for SCIM.
- If SCIM is switched off for your platform, the connection stops working immediately.
- Changes made through SCIM are recorded against a dedicated integration user, so they can be told apart from changes made by your administrators.
Limitations in the Beta
- No groups sync. Groups from your identity provider are not synced to IntelligenceBank groups yet. New users receive the template user's groups. Groups sync is planned for a later release.
- Existing users are not linked automatically. If your identity provider sends an email address that already belongs to an IntelligenceBank user, the request is refused. Those users continue to be managed in IntelligenceBank.
- No self-service setup. IntelligenceBank enables SCIM and issues your credentials.
- Only Active and Suspended statuses sync. Other statuses, such as Blocked, Pending and Declined, are not managed through SCIM.
- No welcome email by default. Users created through SCIM do not receive a welcome email from IntelligenceBank.
- User limits apply. SCIM users count against your platform's user limit. A new user is refused if it would take you over your user or admin limit.
Beta: Capabilities may change during the beta. We recommend testing with a small group of users before assigning your whole organization.
FAQ
| Does SCIM replace Single Sign On? | No. SCIM manages user accounts. It is not a login method. SCIM is typically used alongside SAML Single Sign On, which handles how users log in. |
| Which identity providers can I use? | Any identity provider that supports SCIM 2.0 provisioning with OAuth 2.0 client credentials. Okta and Microsoft Entra ID are common examples. |
| Can I set this up myself? | Not during the beta. Contact IntelligenceBank Support to have SCIM enabled and your credentials issued. |
| What happens to users who already exist in IntelligenceBank? | They are not linked to your identity provider automatically in the beta. If your identity provider tries to create a user whose email address already exists, the request is refused, and the existing user is unchanged. |
| Which groups do new users get? | New users receive the groups of your template user. Their division comes from your identity provider if it sends one, and from the template user otherwise. |
| Can my identity provider's roles be mapped to IntelligenceBank groups? | An optional setting can map the roles your identity provider sends to IntelligenceBank groups. It is off by default. Contact IntelligenceBank Support to discuss it. |
| Do SCIM users count against my user limit? | Yes. If creating a user would exceed your user or admin limit, the request is refused. |
| Is a deleted user's history kept? | Yes. The user is removed from the platform, but their record and history are kept for auditing. |
Need Help?
If you would like to join the SCIM User Provisioning beta, or have questions about setting it up, please contact our support team.
Contact SupportWas this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article