Team Cloud
SCIM provisioning
Since 0.7.0 Requires Cloak Proxy 0.7.0 or later.
Provision and deprovision Team Cloud members from Okta or Microsoft Entra ID with SCIM 2.0, at no extra charge. Deprovisioning cuts access at once.
With SCIM, your identity provider adds people to Team Cloud when you assign them, and removes them when you unassign or deactivate them. It’s included at no extra charge. Roles stay in Team Cloud: SCIM never makes anyone an admin.
What SCIM does
Section titled “What SCIM does”| In your IdP | In Team Cloud |
|---|---|
| Assign a person (create) | An invitation as Member, which reserves a seat. With no free seat, it waits, and the console shows “3 SCIM users waiting for seats” |
| Update a person | Their name is updated. Their email can change only until they join; after that, remove them and invite the new address |
| Unassign, deactivate or delete a person | Removal: their access ends at once, and an admin’s Mac changes the team’s keys. See Remove people |
| Groups | Not used. Assign people individually, or through IdP groups that the IdP expands into people |
Invited people still join from Cloak Proxy, and their first Mac is approved by an admin comparing a code (see Invite and approve people).
For each person, Subcloak keeps the user name, email address, display name and whether they’re active, plus the identity provider’s own id for them (externalId), which Okta and Entra use to match people. We drop every other attribute the identity provider sends.
Create a SCIM token
Section titled “Create a SCIM token”-
On the console’s SSO & SCIM › SCIM, copy the base URL.
-
Click Generate token and confirm with a passkey or a fresh email code. Copy the token: it’s shown once.
-
Enter both in your IdP, as below.
The page shows when the token was last used. Generating a new token replaces the old one. Anyone with the token can add and remove your team’s members, so keep it in your IdP only.
Connect your IdP
Section titled “Connect your IdP”- Open your Cloak Proxy app integration in the Okta Admin Console. On General, set Provisioning to SCIM.
- On Provisioning › Integration, enter the base URL as the SCIM connector base URL and
userNameas the Unique identifier field for users. - Under Supported provisioning actions, choose Push New Users and Push Profile Updates. Don’t choose Push Groups.
- Set Authentication Mode to HTTP Header and paste the token as the bearer token. Click Test Connector Configuration, then Save.
- On Provisioning › To App, turn on Create Users, Update User Attributes and Deactivate Users.
- In the Microsoft Entra admin center, open Enterprise applications and your Cloak Proxy app (or create a non-gallery app).
- Under Provisioning, set Provisioning Mode to Automatic.
- Enter the base URL as the Tenant URL and the token as the Secret Token. Click Test Connection, then Save.
- Under Mappings, keep user provisioning on and turn group provisioning off.
- Assign users, then set Provisioning Status to On.
Supported requests
Section titled “Supported requests”For anyone checking a SCIM client against Team Cloud: /Users supports list with filter=userName eq "…", create, get, PUT, PATCH (active, name, emails) and DELETE. /ServiceProviderConfig, /ResourceTypes and /Schemas are there too. /Groups returns an empty list and accepts no members. Requests need the bearer token, which works only for its own team.