Skip to main content
Proton says “Before setting up SCIM, you must first set up SSO.” SSO needs a verified domain, and SCIM works with Okta or Microsoft Entra ID as the identity provider. Single sign-on is available on Proton Pass Professional, VPN Professional, VPN and Pass Professional and VPN Enterprise. The SCIM token has no scopes or read-only version: it is the same token an identity provider uses, so it can also create and delete users, although StackOne only reads with it. Proton also says SCIM groups are available on Pass Professional, VPN Professional and the VPN and Pass Professional bundle. Proton documents SSO and SCIM for Proton Pass and Proton VPN only; its plans page does not list them for Proton Mail or Workspace plans.

​
Find your SCIM base URL

The SCIM base URL is the address of your organization’s SCIM API. Proton shows it next to the token in the SCIM settings.

  • Copy it from the SCIM settings described in the next section.
  • Format: https://scim.proton.me/{tenantId}/v2/
  • Example: https://scim.proton.me/example-tenant-id/v2/
  • Paste it exactly as Proton shows it into the SCIM Base URL field in StackOne Hub.
  • If you copied it from Microsoft Entra ID with ?aadOptscim062020 at the end, StackOne accepts that too.

​
Get the SCIM token

The SCIM token is the bearer token that Proton generates for SCIM automatic provisioning. Your organization has one SCIM token, and your identity provider uses the same one.

1

Sign in to Proton

Sign in to your administrator account at Proton account for Proton Pass, or at Proton VPN account for Proton VPN.

  • Proton’s SCIM pages ask for administrator privileges. On plans with admin roles, use an Organization Admin.
2

Open the SCIM settings

Go to the SCIM automatic provisioning section.

  • In Proton Pass for Business, go to ⚙ → Organization → Single sign-on → SCIM automatic provisioning.
  • In Proton VPN for Business, go to Settings (⚙) → Single sign-on → SCIM automatic provisioning.
  • If the section shows a Configure SCIM button, SCIM is not set up yet. If it shows “For security reasons, the token is hidden”, SCIM is already set up; go to the step “Use the token of an existing SCIM setup”.
3

Configure SCIM

Click Configure SCIM, copy the SCIM base URL (or tenant URL) and the SCIM token, then click Done.

  • Proton shows the token once: “For security reasons, the SCIM token will be hidden after saving your changes and you won’t be able to see it again.” Store it securely, because your identity provider needs the same token.
  • Paste the token into the SCIM Token field in StackOne Hub.
  • Enter the same base URL and token in your identity provider and turn on provisioning there, as Proton describes for Okta with Proton Pass, Okta with Proton VPN and Microsoft Entra ID. The StackOne connection test fails while Proton’s SCIM API lists no users.
4

Use the token of an existing SCIM setup

Proton keeps the token hidden once SCIM is set up. Use the token your team stored when it set up SCIM.

  • If nobody has it, click Generate new token. Proton warns that “your identity provider settings will need to be updated”: the old token stops working, and provisioning from your identity provider stops until it has the new token.
  • Paste the new token into your identity provider’s SCIM settings (the API Token in Okta, the Secret token in Microsoft Entra ID), then into the SCIM Token field in StackOne Hub.
  • Proton names no expiry for the token.

​
Revoke the token

To stop StackOne from reading your users and groups, replace the token.

  • Open the SCIM automatic provisioning section as above and click Generate new token.
  • Proton replaces the old token, so StackOne can no longer use it.
  • Paste the new token into your identity provider, or its provisioning stops too.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • SCIM Base URL
  • SCIM Token
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.