# SCIM provisioning

> Provision and deprovision Team Cloud members from Okta or Microsoft Entra ID with SCIM 2.0, at no extra charge. Deprovisioning cuts access at once.

Source: https://docs.subcloak.com/cloak-proxy/team/scim/

Added in Cloak Proxy 0.7.0.

{/*
  L9 draft. Sources: PLAN 7.17 SCIM, 6.5, 8.3, 9.5 page 7; LAUNCH 4.2 (SCIM attributes kept).
  VERIFY(L3) before applying: the SCIM base URL format the console shows (assumed https://cloud.subcloak.com/scim/v2/<team id>).
  The IdP steps name the IdPs' own menus as of 2026-10; re-check them against Okta's and Entra's current UIs.
*/}

With SCIM, your identity provider adds people to Team Cloud when you assign them, and removes them when you unassign or deactivate them. It's included at no extra charge. Roles stay in Team Cloud: SCIM never makes anyone an admin.

## What SCIM does

{/* PLAN 7.17 SCIM, 6.5 */}

| In your IdP | In Team Cloud |
|---|---|
| Assign a person (create) | An **invitation** as **Member**, which reserves a seat. With no free seat, it waits, and the console shows "3 SCIM users waiting for seats" |
| Update a person | Their name is updated. Their email can change only until they join; after that, remove them and invite the new address |
| Unassign, deactivate or delete a person | **Removal**: their access ends at once, and an admin's Mac changes the team's keys. See [Remove people](https://docs.subcloak.com/cloak-proxy/team/leaving-and-removal/) |
| Groups | Not used. Assign people individually, or through IdP groups that the IdP expands into people |

Invited people still join from Cloak Proxy, and their first Mac is approved by an admin comparing a code (see [Invite and approve people](https://docs.subcloak.com/cloak-proxy/team/invite-and-approve/)).

For each person, Subcloak keeps the user name, email address, display name and whether they're active, plus the identity provider's own id for them (externalId), which Okta and Entra use to match people. We drop every other attribute the identity provider sends. {/* LAUNCH 4.2; R4D-H6, identity/scim.ts */}

## Create a SCIM token

1. On the console's **SSO & SCIM › SCIM**, copy the **base URL**.

2. Click **Generate token** and confirm with a passkey or a fresh email code. Copy the token: it's shown once.

3. Enter both in your IdP, as below.

The page shows when the token was last used. Generating a new token replaces the old one. Anyone with the token can add and remove your team's members, so keep it in your IdP only.

## Connect your IdP

**Okta**

1. Open your Cloak Proxy app integration in the Okta Admin Console. On **General**, set **Provisioning** to **SCIM**.
2. On **Provisioning › Integration**, enter the base URL as the **SCIM connector base URL** and `userName` as the **Unique identifier field for users**.
3. Under **Supported provisioning actions**, choose **Push New Users** and **Push Profile Updates**. Don't choose **Push Groups**.
4. Set **Authentication Mode** to **HTTP Header** and paste the token as the bearer token. Click **Test Connector Configuration**, then **Save**.
5. On **Provisioning › To App**, turn on **Create Users**, **Update User Attributes** and **Deactivate Users**.

**Microsoft Entra ID**

1. In the Microsoft Entra admin center, open **Enterprise applications** and your Cloak Proxy app (or create a non-gallery app).
2. Under **Provisioning**, set **Provisioning Mode** to **Automatic**.
3. Enter the base URL as the **Tenant URL** and the token as the **Secret Token**. Click **Test Connection**, then **Save**.
4. Under **Mappings**, keep user provisioning on and turn group provisioning off.
5. Assign users, then set **Provisioning Status** to **On**.

## Supported requests

{/* PLAN 7.17 SCIM endpoints */}

For anyone checking a SCIM client against Team Cloud: `/Users` supports list with `filter=userName eq "…"`, create, get, `PUT`, `PATCH` (`active`, `name`, `emails`) and `DELETE`. `/ServiceProviderConfig`, `/ResourceTypes` and `/Schemas` are there too. `/Groups` returns an empty list and accepts no members. Requests need the bearer token, which works only for its own team.

## Related

  - [Single sign-on](https://docs.subcloak.com/cloak-proxy/team/sso/): SSO with OIDC (Okta, Microsoft Entra ID, Google Workspace and other OIDC providers). SAML is coming later.
  - [Remove people and leave a team](https://docs.subcloak.com/cloak-proxy/team/leaving-and-removal/): What happens on deprovisioning.
  - [Billing and seats](https://docs.subcloak.com/cloak-proxy/team/billing-and-seats/): Seats for SCIM users.