SCIM provisioning

With SCIM provisioning, your identity provider (Okta, Microsoft Entra ID or any SCIM 2.0 client) keeps Unifuse users in step with your directory: joiners are created, name changes flow through, and leavers are deactivated and signed out.

Before you start

• You need the manage SCIM permission.
• Open Administration → SCIM Provisioning.

Issue a token

1. Enter a Description that identifies the client, such as “Okta production”.
2. Optionally enter Allowed CIDRs, comma-separated, to accept the token only from your identity provider’s egress addresses. Requests from other addresses are refused.
3. Select Generate token.
4. Copy the token now. It is shown once and cannot be retrieved later.

The list shows each token’s description and its IP restriction, with Revoke. Revoking takes effect immediately.

Configure the identity provider

Setting	Value
SCIM base URL	Your institution’s Unifuse address followed by /api/scim/v2
Authentication	Bearer token (the token issued above)
Supported resources	Users only. Groups are not supported.

Unifuse publishes /ServiceProviderConfig and /ResourceTypes under the base URL for clients that read them.

Supported attributes

SCIM attribute	Unifuse field
userName	Email address (stored lower-case)
name.givenName, name.familyName	Display name
externalId	Single sign-on subject
active	Whether the account is active
Enterprise extension department	Department (set on create and full update)

What SCIM does and does not do

• A new user gets the institution’s default role. SCIM never assigns roles; use Users or an identity-provider role map.
• Setting active to false, or deleting the user, deactivates the account and ends all of its sessions immediately.
• Creating a user whose email belongs to a deactivated account reactivates that account.
• Partial updates (PATCH) support replace operations in both the Okta and Entra ID styles.
• Filters support userName eq, externalId eq and the Entra ID emails[type eq "work"].value eq form. Listings return at most 500 users. Sorting, bulk operations and entity tags are not supported.
• Every provisioning action is recorded in the audit log.

Related

• Single sign-on
• Users