SCIM

Audience: Administrators Edition: Pro

 

SCIM (System for Cross-domain Identity Management) 2.0 lets your Identity Provider (IdP) manage the full OrgChart user lifecycle — provisioning new users, assigning them to Access Groups, and deprovisioning them — entirely outside of a login event. Unlike Auto-Provision, which requires a user to authenticate via SSO before their account is created or updated, SCIM operates independently: users can be provisioned before their first login, Access Group assignments take effect immediately when changed in the IdP, and offboarded users are disabled the moment they are removed in the IdP.

Prerequisites

Before configuring SCIM, confirm the following:

• SAML 2.0 SSO is already configured for your organization. SCIM operates alongside SSO and does not replace it.
• Your IdP supports SCIM 2.0 provisioning (for example, Okta, Microsoft Entra ID, or OneLogin).
• The Access Groups you plan to push from your IdP already exist in OrgChart, or you intend to have your IdP create them via SCIM.

Generating a SCIM Token

OrgChart authenticates SCIM requests using a per-organization bearer token. The token is displayed once at generation time — copy it before closing the dialog, as it cannot be retrieved afterward.

1. Navigate to Account Settings, and then click on Authorization.
    
2. In the SSO Configuration section, scroll to the SCIM area and click Generate Token.
    
3. Copy the token from the dialog and store it securely. You will need it when configuring SCIM in your IdP.
    

Note

To rotate the token, click Revoke Token and then generate a new one. Revoking the token immediately invalidates all active SCIM requests using the old token.

Connecting Your Identity Provider

In your IdP's SCIM provisioning settings, provide the following values. Refer to your IdP's documentation for the exact steps to add a SCIM application.

Setting	Value
SCIM Base URL	[SCIM_BASE_URL]
Authentication Method	Bearer Token (OAuth 2.0)
Bearer Token	The token generated in the previous step.

Most IdPs provide a Test Connection step after you enter these values. Run it to confirm the token and URL are accepted before enabling provisioning.

How SCIM Works in OrgChart

User Provisioning

When you assign a user to the OrgChart application in your IdP, the IdP provisions that user in OrgChart immediately using the following attribute mapping. The user can log in via SSO as soon as provisioning completes — no first-login is required.

IdP Attribute (SCIM)	OrgChart Field
userName	Email Address (primary lookup key)
name.formatted / displayName	Name
active	User enabled/disabled state

If a user with the same email address already exists in OrgChart, provisioning returns a 409 Conflict and no duplicate is created. When a SCIM-provisioned user subsequently authenticates via SSO, OrgChart matches them to their existing record by email — no duplicate is created at login either.

Access Group Assignment

SCIM group push maps IdP groups to OrgChart Access Groups by name. When you push a group membership change from your IdP, OrgChart updates the user's Access Group immediately — no login is required. OrgChart supports exactly one Access Group per user, so adding a user to a new group via SCIM automatically removes them from any previously assigned group.

Caution

If both SCIM group assignment and SAML Group Attribute mapping are active at the same time, they will conflict: SAML Group Attribute mapping overrides any SCIM-assigned group at login time. If you are managing Access Group assignments via SCIM, disable SAML Group Attribute mapping in the SSO Configuration panel to avoid conflicting assignments.

Deprovisioning

When you remove a user from the OrgChart application in your IdP, the IdP sends a deprovision request to OrgChart. OrgChart supports two deprovision behaviors depending on how your IdP is configured:

• Deactivate — sets active: false, disabling the user's account and blocking all subsequent SSO and direct sign-in attempts. The user's record, Access Group, and role are preserved in Manage Users.
• Delete — also soft-deactivates the user. OrgChart does not purge user records via SCIM delete; the record, Access Group, and role remain in Manage Users for auditability.

A SCIM-deactivated user will not be re-enabled by a subsequent SSO login, even if Auto-Provision is enabled. SCIM deactivation takes explicit precedence over just-in-time provisioning. To restore access, reactivate the user in your IdP — OrgChart re-enables the account immediately, with no action required in Manage Users.