Introduction
For admins.
The Provisioning screen shows setup options for automated user account management. With System for Cross-domain Identity Management (SCIM) provisioning you can create, update and deactivate users directly from your Identity Provider (IdP).
Use this page to:
Enable automated provisioning and deprovisioning of users.
Manage user access centrally from your identity platform.
Prerequisites
You need to have the Admin role in Foundational and admin permissions in your IdP.
Supported Identity Providers
Okta
Azure
Custom SCIM
Generic SCIM workflow
There are no IdP parameters to enter into Foundational. The direction is one-way at setup time.
Foundational generates the SCIM endpoint and token, and you paste these into the IdP as part of the process.
Create a Foundational SCIM account in th IdP.
Paste the Foundational endpoint & token into the IdP.
Assign users in the IdP to the SCIM Foundational account.
Test the SCIM setup.
SCIM provisioning workflow for each IdP
We’ve a wizard for each SCIM IdP. Here’s how to open the wizard.
Click your avatar, then go to User Management and select the Provisioning tab.
Click Add Connection. The Setup SCIM connection screen opens.
Enter an integration name.
Click the relevant SCIM icon. A wizard opens specifically for the selected IdP.
Okta
Okta
This is the start screen that also shows the main process steps.
Azure
Azure
This is the start screen that also shows the main process steps.
Custom SCIM
Custom SCIM
This is the start screen that also shows the main process steps.
Troubleshoot SCIM connections
Here are some possible issues and recommendation actions.
Issue | Possible Cause | Action |
Connection test fails | Invalid SCIM endpoint or Bearer token. | Verify the endpoint URL and token from Foundational. Regenerate the token if needed and re-enter it in your IdP. |
Users not created in Foundational | Users or groups not assigned to the Foundational app in the IdP. | Check that users are assigned to the SCIM app. Only assigned users are provisioned. |
Provisioning requests fail |
|
|
(401 Unauthorized) | Token expired or missing in IdP configuration. | Reissue a new SCIM token in Foundational and update it in your IdP provisioning settings. |
Provisioning requests fail |
|
|
(403 Forbidden) | The IdP does not have permission to call the SCIM API. | Confirm that the IdP app has the correct API permissions and is using HTTPS. |
User attributes not syncing | Attribute mapping mismatch between IdP and Foundational. | Review attribute mappings in the IdP (e.g., |
Deactivated users remain active | “Deprovisioning” not enabled in the IdP. | Ensure your IdP provisioning settings include “Deactivate users” or “Disable users on unassignment.” |
Sync delays or missing updates | IdP provisioning interval not immediate. | Check the provisioning schedule in your IdP. Okta and Azure often sync every 40–60 minutes by default. |
Provisioning test succeeds but users don’t appear | Test user created but sync not yet committed. | Wait for the next sync cycle or trigger a manual sync from your IdP. |
Still can’t connect?
Reach out to customer support. We’re here to help!