# SCIM provisioning

> Let your identity provider create, update and deactivate Unifuse users automatically over SCIM 2.0, including the base URL, token issuance, supported attributes and limits.

Source: https://docs.unifuse.ai/administration/scim-provisioning/

With SCIM provisioning, your identity provider (Okta, Microsoft Entra ID or any SCIM 2.0
client) keeps Unifuse users in step with your directory: joiners are created, name changes
flow through, and leavers are deactivated and signed out.

## Before you start

- You need the *manage SCIM* permission.
- Open **Administration → SCIM Provisioning**.

## Issue a token

1. Enter a **Description** that identifies the client, such as "Okta production".
2. Optionally enter **Allowed CIDRs**, comma-separated, to accept the token only from your
   identity provider's egress addresses. Requests from other addresses are refused.
3. Select **Generate token**.
4. Copy the token now. It is shown once and cannot be retrieved later.

The list shows each token's description and its IP restriction, with **Revoke**. Revoking
takes effect immediately.

## Configure the identity provider

| Setting | Value |
|---|---|
| SCIM base URL | Your institution's Unifuse address followed by `/api/scim/v2` |
| Authentication | Bearer token (the token issued above) |
| Supported resources | Users only. Groups are not supported. |

Unifuse publishes `/ServiceProviderConfig` and `/ResourceTypes` under the base URL for
clients that read them.

## Supported attributes

| SCIM attribute | Unifuse field |
|---|---|
| `userName` | Email address (stored lower-case) |
| `name.givenName`, `name.familyName` | Display name |
| `externalId` | Single sign-on subject |
| `active` | Whether the account is active |
| Enterprise extension `department` | Department (set on create and full update) |

## What SCIM does and does not do

- A new user gets the institution's default role. SCIM never assigns roles; use
  [Users](/administration/users/) or an identity-provider
  [role map](/administration/single-sign-on/#mapping-roles).
- Setting `active` to false, or deleting the user, deactivates the account and ends all of its
  sessions immediately.
- Creating a user whose email belongs to a deactivated account reactivates that account.
- Partial updates (`PATCH`) support `replace` operations in both the Okta and Entra ID styles.
- Filters support `userName eq`, `externalId eq` and the Entra ID
  `emails[type eq "work"].value eq` form. Listings return at most 500 users. Sorting, bulk
  operations and entity tags are not supported.
- Every provisioning action is recorded in the [audit log](/administration/audit-log/).

## Related

- [Single sign-on](/administration/single-sign-on/)
- [Users](/administration/users/)