What is SCIM?
By enabling SCIM provisioning, you can configure a push-based directory sync from your identity provider (idP) to Secureframe. User and user updates (e.g. active status) are pushed to Secureframe in near real-time.
SCIM (System for Cross-domain Identity Management) is a standard protocol that automates the management of user identities across systems. SCIM simplifies tasks like creating, updating, and deactivating user accounts in multiple systems. It’s particularly useful for organizations with a large user base, as it reduces the manual effort required to maintain accurate user data.
Key features of SCIM:
Automates user provisioning and deprovisioning.
Ensures consistency of user data across connected systems.
Reduces administrative overhead by syncing user data from a central identity provider (IdP) to other applications.
Setting up SCIM
Note: SCIM is available on the Complete plan only. If you are on Complete and do not see the SCIM Settings tab in Company Settings, reach out to [email protected] to discuss enabling this feature.
In Secureframe, go to Company Settings → SCIM Settings.
Click Start configuring SCIM.
Click Add SCIM Connection and follow the step-by-step workflow on the screen. If your provider is not listed, select Custom SCIM to set up a custom connection.
Automatic Invites
SCIM create is not the same as invite. Users can sync into Secureframe as Not invited or Uncategorized until Automatic group invites is enabled for their SCIM group and an employment type (Employee or Contractor) is set.
By default, Secureframe imports SCIM groups. To automatically invite users from your SCIM sync:
Go to Personnel.
Open Personnel Settings.
Open Invite personnel.
Add the SCIM group to the Automatic group invites selector (make sure the toggle is checked).
If you don't see SCIM groups in this selector, make sure you have provisioned them in the SCIM app you've setup in your identity provider (idP). Groups from a SCIM connection are prefixed with the idP vendor name, for example, "Okta SCIM - Contractors".
Frequently Asked Questions (FAQ)
I already have a Secureframe SAML app set up in Okta, do I need to create a second app to enable SCIM provisioning, or can I add SCIM to the existing SAML app?
While it may be possible to add SCIM to your existing SAML app in Okta, we recommend creating a separate SCIM app as outlined in the WorkOS SCIM setup instructions (usually titled "SCIM 2.0 Test App (OAuth Bearer Token)" in Okta). This approach ensures full compatibility and minimizes configuration issues.
To enable SCIM, navigate to your Secureframe Company Settings → SCIM Settings:
https://app.secureframe.com/company-settings/scimSettings
Is a SCIM connection the same as an SSO connection?
No, a SCIM connection is separate from an SSO connection. They serve different purposes: SCIM handles user-related data synchronization, while SSO focuses only on authentication.
Note that SCIM is not the only way user data gets into Secureframe. Some identity provider integrations, like the standard Okta connection, can sync users on their own, but only SCIM provides automatic provisioning and deactivation as part of the full personnel lifecycle.
Does setting up an SSO connection sync user-related data?
No, setting up an SSO connection does not sync user-related data. SSO is limited to authentication and does not involve provisioning or updating user accounts.
How can I sync user-related data?
Several integrations can sync some user data into Secureframe on their own. For example, a standard Okta connection can sync users and account security data without SCIM. SCIM is the option built for the full personnel lifecycle, since it lets your identity provider automatically provision new users and deactivate them the moment they leave. If you need that level of automatic provisioning and deactivation, set up SCIM as described above.
How do I enable and set up SCIM?
SCIM is available on the Complete plan. If you have Complete, go to Company Settings → SCIM Settings and follow the setup steps in this article.
If you are on Complete and do not see the SCIM Settings tab, SCIM may not be enabled on your account yet. Reach out to [email protected] to discuss enabling this feature.
Do I need both SCIM and SSO?
In many cases, organizations benefit from using both SCIM and SSO together. Here’s why:
SSO streamlines login and enhances security by centralizing authentication.
SCIM ensures that user data stays consistent across systems and automates user lifecycle management.
For example, when a new employee joins, SCIM can automatically create their account in multiple applications, and SSO allows them to access these applications with a single login.
Why did SCIM create users in Secureframe, but they were not invited or assigned as Employees?
SCIM can create the personnel record without inviting the user or setting employment type. Invites only go out when Automatic group invites is enabled for the SCIM group under Personnel → Personnel Settings → Invite personnel, and that group is provisioned from your identity provider.
Users can also land as Uncategorized or on the Non-personnel tab if employment type is not set, which blocks normal employee workflows.
Check that: (1) the user is in a synced SCIM group in your IdP, (2) that group is selected under Automatic group invites with the toggle on, (3) the personnel record is Active, invited or invite-pending, and typed as Employee or Contractor.
If you just migrated identity providers (for example to JumpCloud), re-check groups and Automatic invites on the new SCIM connection. Creating users via SCIM alone does not invite them.
If records exist but stay Not invited after you fix Automatic invites and employment type and re-sync, contact Support with the IdP name, SCIM group name, and one example user email.