Provision users with SCIM

SCIM lets your identity provider (Microsoft Entra, Okta, OneLogin, and any other SCIM 2.0 capable IdP) manage the user lifecycle in Onplana automatically: new hires get accounts, role changes flow through, and leavers lose access the moment your IT team deactivates them.

Before you start

• SSO must be configured with at least one verified email domain. SCIM refuses to create users whose email domain is not on the verified list.
• You need admin access to your identity provider.

Set it up

1. Open Organization Settings, go to the Security & Compliance tab, and find the SCIM section.

2. Generate the SCIM bearer token and copy your organization’s endpoint URL. The token is shown once; if you lose it, regenerate.

3. In your identity provider, create a SCIM-enabled app, paste the endpoint URL and token, and assign the users or groups who should be provisioned.

Roles

Provisioned users land as Member by default, which is the lowest-effort setup. If you want your IdP to drive roles instead, map a role attribute with the values MEMBER, MANAGER, or ADMIN, or push one of the three fixed groups named Members, Managers, or Admins.

Deactivation is per organization

When your IdP deactivates a user, only their membership in your organization is suspended. If the person also belongs to other Onplana organizations (a freelancer working with several clients, for example), those memberships are untouched and they keep signing in there.

Deactivation preserves everything: the membership row, team assignments, reviewer designations, and work history all survive. The person simply cannot access your organization while deactivated, and other admins see a deactivated badge next to their name.

When your IdP reactivates the user, Onplana restores the membership with the role they held before deactivation. Nothing needs to be re-created.

Tip

Because deactivation is reversible and loss-free, it is safe to let your IdP drive it aggressively, for example suspending accounts during extended leave. Reactivation puts everything back as it was.

Best practices

1. Configure SSO first, then SCIM. SCIM depends on SSO’s verified domain list. Reversed order causes provisioning errors.
2. Map roles via IdP groups, not per-user attributes. Group membership scales better than per-user role assignment.
3. Let the IdP drive lifecycle aggressively. Deactivation is per-org + lossless. Reversible suspension during leave is safe.
4. Audit SCIM events monthly. The audit log shows every provision + deactivate + role change. Catches misconfigurations before they accumulate.
5. Store the SCIM bearer token in IdP secret vault. Treat it like an API key. If it leaks, regenerate immediately.

Troubleshooting / common pitfalls

• Provision rejected with email domain error. Domain not on verified list. Add via SSO configuration.
• User created in IdP but no Onplana account. Not assigned to the SCIM app. Assign in IdP.
• Role not flowing through. IdP not pushing the role attribute. Check IdP app config + role mapping.
• Deactivated user still in audit log as active member. Audit log captures historical state. Current state in Access Review.
• Token regenerated, IdP stopped syncing. Update token in IdP app.

How this combines with other features

• SCIM + SSO. Auth + provision. The Enterprise identity pair. See Configure single sign-on.
• SCIM + Per-org deactivation. Deactivation is per- org via OrganizationMember.isActive.
• SCIM + Audit log. Every SCIM event writes to audit log. See Read audit logs.
• SCIM + Compliance. Audit trail of provisioning events satisfies most compliance regimes.

Coming from another tool

Tool	Mapping
Okta SCIM	Direct concept
Microsoft Entra SCIM	Direct
OneLogin SCIM	Direct
Custom IdP provisioning	Standard SCIM 2.0
Manual user lifecycle	Onplana SCIM automates this

FAQs

Does deactivating a user delete their work? No. Tasks, comments, time entries, and history stay attached to the person. Deactivation only blocks their access to your organization.

Can a deactivated reviewer block a governance gate? No. Deactivated members are skipped when approval quorums are calculated, so a panel never waits on someone who cannot sign in.

What happens if my IdP sends a user with an unverified email domain? The request is rejected with a clear error. Add the domain to your verified list in the SSO configuration and re-run provisioning.

Where do I see what SCIM has done? Provisioning events are written to the audit trail. See Read audit logs.

Can SCIM provision projects (not just users)? No, SCIM provisions users + memberships. Projects are not provisioned.

Does SCIM support group hierarchies? SCIM 2.0 supports groups; Onplana uses the three fixed groups (Members, Managers, Admins) for role mapping.

What if my IdP isn’t SCIM 2.0 compatible? Use just-in-time provisioning via SSO instead, or write a custom integration via the MCP API.

Related

• Configure single sign-on, auth side
• Read audit logs, SCIM event history
• Understand roles and permissions, role mapping