> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/configuration/sso/scim.md).

# SCIM provisioning and IdP groups

Provision users from your identity provider with SCIM 2.0, and map external IdP groups to CISO Assistant user groups so that roles are granted automatically.

SCIM 2.0 lets your identity provider (Okta, Microsoft Entra ID, Keycloak, …) push users into CISO Assistant automatically, so you no longer have to create accounts by hand. **IdP groups** are the bridge between a group that exists in your identity provider and the CISO Assistant user groups it should grant.

{% hint style="info" %}
SCIM provisioning itself — the **SCIM** settings tab and pushing users in from your IdP — is a **PRO** feature, gated by the `idp_groups` [Feature flags](/ciso-assistant/configuration/settings/feature-flags.md) (enabled by default on PRO instances). The **IdP groups** menu and the **IdP groups** column on the users table described below are Community-available: either `idp_groups` or the Community `jit_provisioning` flag (see [Auto-provisioning (JIT)](/ciso-assistant/configuration/sso.md#auto-provisioning-jit)) unlocks them, so IdP group mapping works for SSO auto-provisioned users too, without SCIM.
{% endhint %}

<figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-5ce292f408d4650d48d9d76735729df04b402d89%2Fscim-feature-flag.png?alt=media" alt=""><figcaption><p>The <strong>IdP groups</strong> feature flag in Settings › Feature flags.</p></figcaption></figure>

### How it works

Authentication and provisioning are two separate concerns, handled by complementary mechanisms:

* Your IdP **authenticates** users through [SAML](/ciso-assistant/configuration/sso/saml.md) or [OpenID Connect (OIDC)](/ciso-assistant/configuration/sso/oidc.md).
* Your IdP **provisions** users and their group memberships, either through SCIM, or — for IdPs without SCIM, or for auto-provisioned users — by carrying the user's groups directly in the SAML/OIDC login assertion (see [Groups attribute mapping](/ciso-assistant/configuration/sso.md#auto-provisioning-jit)). Both feed the same **IdP group** membership.

The link between the two worlds is the **IdP group** — a faithful mirror of a group that exists in your identity provider. An administrator maps each IdP group to one or more **user groups**. A user who belongs to an IdP group then inherits the roles of every user group it is mapped to.

This is a *groups of groups* model: membership flows from **IdP group → user groups → roles**, and the effective roles are recomputed on the fly. A user's direct (manually assigned) user groups and the ones inherited through their IdP groups are simply added together — neither overrides the other.

{% hint style="info" %}
An IdP group grants nothing until you map it to at least one user group. SCIM can keep pushing memberships into an unmapped IdP group safely; those users gain access only once the mapping exists.
{% endhint %}

### Managing IdP groups

IdP groups live under **Organization > IdP groups** in the sidebar. The page behaves like any other object table — view, create, edit and delete.

<figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-dbc7f6d0d8db1d8287c18debe50d0435c2a76425%2Fscim-idp-groups-list.png?alt=media" alt=""><figcaption><p>Organization › IdP groups — each IdP group and the user groups it grants.</p></figcaption></figure>

Creating or editing an IdP group asks for two things:

* **Name** — the display name of the group as it exists in your identity provider.
* **User groups** — one or more CISO Assistant [User groups](/ciso-assistant/configuration/organization/user-groups.md) this IdP group should grant. Edit this list at any time; every member of the IdP group is re-granted immediately.

<figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-3f17ce5d07450056a3ec4af3b80c4c0113ac224d%2Fscim-idp-group-form.png?alt=media" alt=""><figcaption><p>Creating an IdP group: its IdP-side name and the user groups it grants.</p></figcaption></figure>

The **members** of an IdP group are synced automatically — by SCIM if it's configured, or by the group claim in the user's SAML/OIDC login assertion otherwise — and shown read-only. You will also find an **IdP groups** column on the **Organization > Users** table, listing the IdP groups each user belongs to.

<figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-9ea02f42171048d531277f9b878145abe1ce518e%2Fscim-users-idp-groups-column.png?alt=media" alt=""><figcaption><p>The IdP groups column on the users table shows each user's synced IdP group memberships.</p></figcaption></figure>

{% hint style="info" %}
IdP groups are administered globally and are only visible to administrators, just like [User groups](/ciso-assistant/configuration/organization/user-groups.md) and roles.
{% endhint %}

### Configuring SCIM

<figure><img src="https://629777851-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCqFeU3oPCgDWkkR386NK%2Fuploads%2Fgit-blob-0690bf12424270b3c56a878906c4b080646781ff%2Fscim-settings-tab.png?alt=media" alt=""><figcaption><p>Settings › SCIM — the endpoint URL and bearer-token management.</p></figcaption></figure>

1. Log in as an **administrator > Extra > Settings** and open the **SCIM** tab.
2. Copy the **SCIM endpoint URL** (for example `https://<your-instance>/api/scim/v2/`). This is the base URL your identity provider connects to.
3. Click **Generate token** and copy the bearer token that is displayed.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><mark style="color:orange;">The token is shown only once. Copy it now — for security reasons it cannot be retrieved again.</mark> If you lose it, revoke it and generate a new one.</p></div>
4. In your identity provider's provisioning settings, enter the SCIM endpoint URL and authenticate with the token using the **`Authorization: Bearer <token>`** scheme.
5. Assign users and groups to CISO Assistant in your identity provider, and let it provision them.

You can generate several tokens (one per integration) and **revoke** any of them at any time from the same screen.

### Identity, renames and deletion

* Each IdP group is identified by the UUID that CISO Assistant assigns it. Your identity provider stores that id and reuses it, so **renaming a group in the IdP simply updates its name** — memberships and the user-group mapping are preserved.
* The first time your IdP pushes a group that does not exist yet, CISO Assistant **creates the IdP group automatically**.
* **Deleting** an IdP group (or removing it from the IdP) removes the access it granted, but never touches a user's manually assigned user groups — those are a separate, direct membership.

### Notes

* SCIM provisions accounts; it does not replace authentication. Provisioned users still sign in through your configured [SSO](/ciso-assistant/configuration/sso.md) provider.
* CISO Assistant implements the inbound SCIM 2.0 Users and Groups resources (RFC 7643/7644) and is identity-provider agnostic.

### Related

* [SSO](/ciso-assistant/configuration/sso.md)
* [User groups](/ciso-assistant/configuration/organization/user-groups.md)
* [Understanding the IAM model](/ciso-assistant/configuration/organization/iam-model.md)
* [Feature flags](/ciso-assistant/configuration/settings/feature-flags.md)
* [Community vs PRO](/ciso-assistant/introduction/editions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/configuration/sso/scim.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.