SCIM provisioning

With SCIM 2.0, your directory — Entra ID, Okta, or anything that speaks the standard — adds people to the organization when they are assigned the application, and removes them when they are not.

Set it up

1. Verify the email domains your people use: verified domains.

2. In the organization’s Security section, create a provisioning token. It asks you to confirm with a second factor, and is shown once. Tokens last a year by default (two at most); five may be live.

3. In your directory, configure SCIM provisioning with:

   Setting	Value
   Tenant URL	https://api.infrality.io/api/scim/v2
   Secret token	the provisioning token

The token is the organization: nothing in a request can name another one.

Users

• Created people join as members. Their address (primary email, else userName) must be on a verified domain.
• An existing Infrality account with that address is used — never duplicated.
• The directory never changes the account itself: not its address, names or credentials. The account belongs to the person and to every organization they are in.
• Deactivating or deleting a user removes them from the organization — memberships, team seats, shares, open sessions on its boards — and ends every session of an address on the organization’s verified domains. The last owner is never removed.
• Reactivating makes them a member again.

Groups

Directory groups become teams, marked as managed by the directory. Their members can only be the organization’s provisioned, active members. Nobody can edit those teams by hand. Teams made by hand are not visible to the directory.

What is supported

Users and Groups with GET, POST, PUT, PATCH and DELETE; filters eq on userName and externalId (users) or displayName and externalId (groups); paging; PATCH in the shapes Entra ID and Okta send. Anything else is answered with a SCIM error.

Every change is recorded in the audit trail, with the directory named as the actor.