SCIM (System for Cross-domain Identity Management) is an HTTP and JSON standard for creating, updating and removing user and group records across systems. It handles the account lifecycle that single sign-on does not. SSO answers who signed in. SCIM keeps the account list correct.
The gap SCIM fills
SSO lets people authenticate with the company identity provider. It does not by itself create an account in the app ahead of time, change a department when someone moves, or remove access when they leave. Without provisioning, teams do that by hand, and leavers keep accounts for far too long.
SCIM 2.0 is defined by two RFCs. RFC 7643 describes the schema, and RFC 7644 describes the protocol.
What SCIM manages
Core resource types:
- User. Required
userName, plusexternalIdset by the provisioning client,emails, anactiveflag, andmetathat the server controls. - Group. Requires
displayNameand hasmembers, which can include users and nested groups.
The enterprise extension adds employeeNumber, costCenter, organization, division, department and manager.
A resource lists the schemas it uses in a required schemas array.
How the protocol works
SCIM uses standard HTTP methods on well known endpoints.
/Usersand/Groupsfor resources/ServiceProviderConfig,/ResourceTypesand/Schemasfor discovery/Bulkfor batched changes/Meas an alias for the authenticated subject
GET reads, POST creates, PUT replaces, PATCH makes partial changes, DELETE removes. Filtering supports operators such as eq, co, sw and pr, and paging uses startIndex and count.
What it does not do
- It does not authenticate users. Pair it with SAML or OIDC.
- It does not decide which permissions a role has inside the app. It only passes group membership. Your app must map groups to roles.
- It does not guarantee the target app handles deactivation well. Check what
activefalse really does in each app.
Why security teams care
- Joiners get accounts with the right groups from day one.
- Movers have group changes applied without a ticket.
- Leavers lose access when the identity provider says so, in minutes rather than weeks.
- Audits can compare the identity provider's list with each app's list.
What to check before you rely on it
- Does the app support SCIM for the plan you pay for?
- Does it support groups, or only users?
- What happens on deactivate, and do sessions and API tokens end too? See SCIM offboarding.
- Is the SCIM bearer token stored and rotated like any other credential?
- Are provisioning errors visible to someone who will act on them?
Quick check
Do I need SCIM if I have SSO?
SSO alone leaves account creation and removal manual. SCIM automates the lifecycle, which closes the leaver gap.
Is SCIM only for users?
No. It also covers groups and custom resources and extensions.
Sources
Last reviewed: 19 October 2026.
