> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SCIM Provisioning
> Set up SCIM provisioning to create and deactivate StackOne members automatically from your identity provider.
SCIM Provisioning creates and deactivates your StackOne members automatically from your identity provider (IdP) over SCIM (System for Cross-domain Identity Management). Create a user in your IdP and they become a member of your StackOne organization; deactivate them and StackOne suspends their access.
SCIM Provisioning is part of your organization's SSO connection, not a connection of its own. You enable it on an SSO connection that already exists, so [set up SSO](/identity/sso/overview) first. In the dashboard it lives on the **Directory Sync** card of that connection's **Provisioning** tab.
## How SCIM Provisioning works
SCIM Provisioning links your IdP to that SSO connection and keeps its membership aligned with your directory.
SCIM Provisioning can also push your identity provider's groups into StackOne as synced groups, which you assign to projects and accounts like any other group. See [SCIM Groups](/identity/scim/groups).
An organization has a single SCIM Provisioning. If you run more than one SSO connection, it binds to the **oldest** one and appears on every connection's **Provisioning** tab. Link and manage it there, and point one IdP at the SCIM base URL. StackOne doesn't support more than one SCIM source per organization.
### Provisioning
When you assign a user to the StackOne application in your IdP, StackOne:
* Adds them to your organization at the **Viewer** role, or **Admin** when your identity provider sends a `roles` value of `admin`. See [organization role from your identity provider](/identity/sso/jit-provisioning#organization-role-from-your-identity-provider) for the mapping.
* Grants them the connection's **provisioned access**: the projects you selected, each at the role you set for it (**Viewer**, **Member**, or **Admin**).
* Adds them to any [synced groups](/identity/scim/groups) your identity provider pushes them into, so they inherit the access those groups grant.
* Marks their email as verified only when your organization has DNS-verified that email's domain, so SSO can recognize and link the same person the first time they sign in.
The organization role is set the first time a user is provisioned. Changing the `roles` value in your identity provider later doesn't change an existing member's role. Adjust an existing member's role from the dashboard instead.
### Deprovisioning
When you deactivate or remove a user in your IdP, StackOne suspends their access to that organization, removes them from their synced groups, and signs them out. The suspension is an org-scoped ban, so the user keeps any access they have in other organizations. Reactivating the user in your IdP lifts the suspension, unless an admin applied the ban manually from the dashboard.
Only members this connection provisioned are affected. A member who joined by invitation, or who was provisioned by a different connection, is left untouched. SCIM Provisioning also won't deactivate the last active admin of an organization, so a sync can't lock everyone out, to offboard your last admin, promote or provision another org admin first.
Two deactivations intentionally fail on StackOne's side and appear as errors in your IdP's provisioning log. Both are expected and safe to ignore:
* Deactivating the **last active admin** is refused. Your IdP surfaces a failed provisioning action for that user and retries it on each sync.
* Deactivating a member this connection didn't provision, someone who joined by invitation, or was synced by a different connection, returns "user not found".
## Prerequisites
* A verified SSO connection for your organization, since SCIM Provisioning is enabled on it. See [SSO overview](/identity/sso/overview).
* The **Org Admin** role.
The projects and roles synced members receive are the connection's shared **provisioned access**, set on the **Provisioned access** card of the **Provisioning** tab. [JIT provisioning](/identity/sso/jit-provisioning) applies the same set, so configuring it once covers both.
Verify your SSO domain **before** you assign users in your IdP. StackOne doesn't block linking SCIM on an unverified connection, but until the domain is verified, provisioned users are created with their email **unverified**, so a later SSO sign-in isn't recognized as the same person, and you can end up with duplicate or orphaned accounts. Confirm **Verification Status: Verified** on the connection's **General** tab first.
## Enable SCIM Provisioning
Link SCIM from the SSO connection's **Provisioning** tab, then finish the setup in your IdP.
In the StackOne dashboard, go to **Organization > Security > SSO** and open your verified SSO connection. Select the **Provisioning** tab, then, on the **Provisioned access** card, select **Manage access**.
Pick the projects synced members should join and choose a role for each one (**Viewer**, **Member**, or **Admin**), then select **Save changes**. Pick the least-privilege role that fits each project. Every provisioned user is still added to your organization at the **Viewer** role (or **Admin** from your identity provider), regardless of the project roles you choose. This access is shared with [JIT provisioning](/identity/sso/jit-provisioning).
On the **Directory Sync** card, select **Link SCIM**. StackOne creates the connection and opens the **Directory Sync** panel with your SCIM credentials. If you haven't set any provisioned access yet, linking walks you through picking it first.
In the **SCIM Details** section, copy the **SCIM base URL** and the **Provisioning token**. You paste both into your IdP.
Copy the **SCIM base URL** and **Provisioning token** now. The token is shown only once: closing the panel hides it for good, and you'd have to regenerate it. Store it somewhere safe.
To rotate the token later, select **Regenerate**, then **Confirm rotate**. Rotating invalidates the previous token immediately and breaks any IdP still using the old one, so update your IdP with the new value right away.
In your IdP, enable provisioning for the StackOne application, paste in the SCIM base URL and token, then assign the users who should sync. Follow the guide for your IdP in [Next steps](#next-steps).
## Manage or remove SCIM Provisioning
Manage the connection from the **Directory Sync** card on the SSO connection's **Provisioning** tab.
* **Edit SCIM** reopens the **Directory Sync** panel to rotate the token. To change the projects synced members join or their roles, use **Manage access** on the **Provisioned access** card instead.
* **Unlink** stops all future provisioning and revokes the SCIM token. Members synced so far keep their access, and synced groups become normal groups that keep their members and assignments. You can link again later, but StackOne mints a **new** token, the SCIM base URL doesn't change, so you only need to paste the new token back into your IdP.
Deleting the SSO connection also removes SCIM Provisioning and revokes its token, because SCIM Provisioning rides on that connection. The delete confirmation warns you when SCIM Provisioning is linked. Members synced so far keep their access, and synced groups become normal groups. If you delete and recreate the connection, for example to replace a certificate, link SCIM again and paste the new token into your IdP. Groups your IdP pushes again take over the groups they left behind.
## Next steps
Enable SCIM provisioning on an Okta SSO connection.
Enable SCIM provisioning on a Microsoft Entra SSO connection.
Set up the SSO connection that SCIM Provisioning builds on.
Push your identity provider's groups into StackOne and grant access through them.