What is SCIM? A practical guide to SCIM 2.0 provisioning
SCIM 2.0 (RFC 7643/7644) is the open standard for creating, updating and deactivating user accounts across apps. How it works and what you need to use it.
SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning. An identity source, such as Google Workspace, sends standard HTTP requests to each app's SCIM endpoint to create accounts, keep their attributes up to date, manage group membership and deactivate users when they leave. Version 2.0 is defined by two IETF documents: RFC 7643 (the schema) and RFC 7644 (the protocol).
Why SCIM matters
Without SCIM, every new hire means creating accounts by hand in each tool, and every departure means remembering to remove them. SCIM replaces that checklist with a sync:
- Onboarding: a user added to the right group in the directory gets an account in every connected app.
- Changes: a new title, department or name is pushed everywhere automatically.
- Offboarding: a suspended user is deactivated in every app at the next sync, closing access that would otherwise linger.
- Audit: every change is an HTTP request with a response code, which is easy to log and review.
SSO (SAML or OIDC) and SCIM solve different problems. SSO decides how a user signs in; SCIM decides whether the account exists and what it contains. Most teams use both.
How SCIM works
A SCIM service provider (the app) exposes a REST API under a base URL, usually ending in /scim/v2. The client (AnySCIM, on behalf of your directory) authenticates with a bearer token and works on two resource types:
| Endpoint | Purpose |
|---|---|
/Users | Create, read, update and deactivate user accounts |
/Groups | Create groups and manage their members |
/ServiceProviderConfig | Describe which optional features the app supports (PATCH, filtering, bulk) |
/Schemas, /ResourceTypes | Describe the attributes the app accepts |
A typical sync uses a handful of operations:
GET /scim/v2/Users?filter=userName eq "giulia.ferri@acme.it"
POST /scim/v2/Users # create the account
PATCH /scim/v2/Users/{id} # update attributes, or set active=false
PATCH /scim/v2/Groups/{id} # add or remove membersA minimal user looks like this:
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"userName": "giulia.ferri@acme.it",
"name": { "givenName": "Giulia", "familyName": "Ferri" },
"emails": [{ "value": "giulia.ferri@acme.it", "type": "work", "primary": true }],
"active": true
}What you need to connect an app
For every app you want to provision you need three things:
- A plan that includes SCIM. Many vendors reserve SCIM for business or enterprise tiers. Each integration guide lists the requirement.
- The SCIM base URL of your account or tenant.
- A bearer token created by an administrator of that app.
AnySCIM then needs read-only access to your Google Workspace directory. See Connect Google Workspace as the source directory.
How AnySCIM applies SCIM
- Users are matched by
userName, which AnySCIM sets to the user's primary Google email. - Existing users are updated with
PATCH, and only when an attribute actually changed. - Suspended Google accounts are sent as
active: false(configurable in Settings). - Group membership can be pushed as SCIM groups, with nested Google groups expanded.
- Every connection shows a dry-run of the first sync before anything is written.
FAQ
Is SCIM the same as SSO?
No. SSO (SAML or OIDC) handles authentication when a user signs in. SCIM handles provisioning: it creates, updates and deactivates the account itself. They are complementary, and many apps require SSO to be configured before SCIM can be enabled.
What is the difference between SCIM 1.1 and SCIM 2.0?
SCIM 2.0 (RFC 7643/7644, published in 2015) is the current version and the one almost every modern app implements. AnySCIM speaks SCIM 2.0 only.
Does SCIM sync passwords?
Not with AnySCIM. Users sign in through SSO or the app's own login; AnySCIM never reads or transmits passwords.
Which apps support SCIM?
Most business SaaS apps do, usually on business or enterprise plans: Slack, GitHub Enterprise, Atlassian, Salesforce, Notion, Figma, Asana, Linear and many others. Any app with an RFC 7644 compliant endpoint can be connected as a custom SCIM 2.0 connection.
Try it on your own directory
Connect Google Workspace and preview the first sync in dry-run: nothing is sent until you activate the connection.
