System for Cross-domain Identity Management (SCIM) is a standard used to automate user provisioning between systems. SCIM allows an Identity Provider (IdP), such as Okta or Azure Active Directory (Azure AD), to automatically create, update, and deactivate user accounts in another platform without requiring manual administration.
This article covers:
What System for Cross-domain Identity Management (SCIM) is and how it works
The differences between SCIM and Security Assertion Markup Language (SAML)
How to configure SCIM provisioning in Okta
How to configure SCIM attributes for teams and roles
SCIM vs SAML
System for Cross-domain Identity Management (SCIM) focuses on managing user accounts, while Security Assertion Markup Language (SAML) focuses on user authentication and sign-in. With SAML and Just-in-Time (JIT) provisioning, user accounts can be created automatically when a user signs in for the first time, without requiring SCIM.
SCIM is recommended when you need ongoing user lifecycle management, including updating user details, managing roles, and automatically removing access when users leave an organization. SAML with JIT provisioning is often suitable for simpler deployments that do not require full lifecycle management.
In many enterprise environments, SCIM and SAML are used together. SCIM provisions and synchronizes user accounts, while SAML provides a seamless sign-in experience.
Feature | SCIM | SAML |
Purpose | Automates user provisioning and lifecycle management | Authenticates users and enables Single Sign-On (SSO) |
User account creation | Creates users automatically through provisioning | Can create users through Just-in-Time (JIT) provisioning |
User updates | Synchronizes user profile and role changes | Does not manage user updates |
User deprovisioning | Automatically removes access when users leave | Does not manage deprovisioning |
Authentication | No | Yes |
Best suited for | Organizations that need user lifecycle management and synchronization | Organizations that need Single Sign-On (SSO) authentication |
Common enterprise usage | Often used alongside SAML | Often used alongside SCIM |
Configuring SCIM in Okta
Follow the steps in the How do I configure SAML Single Sign-On (SSO) with Okta? article to setup a Single Sign-On (SSO) application integration.
Navigate to the SCIM form in Okta by selecting App Integration > Provisioning > SCIM Connection.
Complete the SCIM configuration form using the following settings:
When you reach HTTP Header > Authorization, refer to the SAML integration page in CisionOne and generate a SCIM token.
Copy the token and paste it into the Authorization field in Okta.
After entering all the required details in the Okta SCIM form, select Test Connector Configuration to verify the connection. If the test is successful, the following screen is displayed.
Enable the required provisioning actions to allow Okta to create, update, and deactivate users automatically.
When you add, remove, or update a user in the Identity Provider (IdP), the changes are automatically synchronized with the user's profile in CisionOne.
Note: Use the authorization token generated in the SAML integration modal when configuring SCIM authentication.
Setting up attributes for SCIM
If you want to synchronize teams and user roles, complete the following steps:
When configuring SCIM attributes, add the External Namespace field as shown in the screenshot below.
For teams:
External namespace: urn:ietf:params:scim:schemas:extension:teams:2.0:User
External name: primary_team
To synchronize user roles, configure the following external namespace:
External namespace: urn:ietf:params:scim:schemas:extension:roles:2.0:User
Use one of the following external names, depending on the role you want to assign:
• monitoring_user_role
• social_user_role
• outreach_user_role
When you add, remove, or update a user in the Identity Provider (IdP), the changes are automatically synchronized with the API and Identity service
