SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning. When SCIM is configured, your Identity Provider (IdP) automatically creates, updates, deactivates, and deletes Prizm user accounts whenever changes are made in your directory — no manual user management required.
How it works
- Prizm exposes a SCIM Callback URL visible under Profile → Organization → SSO/SAML.
- You configure your IdP to send provisioning requests to that URL using a bearer token for authentication.
- Whenever a user is added, changed, or removed in your IdP, it pushes a SCIM request to Prizm.
- Prizm applies the change — creating the account, updating the profile, or deactivating access.
Supported providers
IBM Security Verify supports user provisioning only. Group synchronization is not available for IBM. Use Okta, Azure AD, or Ping Identity if group-based access management is required.
What SCIM manages
Prerequisites
- SAML SSO must already be configured in Prizm for your IdP before enabling SCIM.
- You need admin access to both Prizm (Profile → Organization → SSO/SAML) and your IdP.
- A static bearer token is required for the IdP to authenticate to Prizm’s SCIM endpoint.
Finding the SCIM Callback URL
- In Prizm, navigate to Profile → Organization → SSO/SAML.
- Locate the SCIM Callback URL field (read-only).
- Copy this URL — paste it into your IdP’s SCIM provisioning configuration as the SCIM Base URL or Tenant URL.
Setup by provider
Okta
Azure AD / Entra ID
Ping Identity
IBM Security Verify
Prerequisites
- Okta SAML SSO is already configured for Prizm.
- You have Okta Administrator access.
- You have the Prizm SCIM Callback URL.
Step 1 — Open SCIM provisioning in Okta
- In the Okta Admin Console, navigate to Applications and open the Prizm SAML application.
- Go to the Provisioning tab → Integration section.
- Click Configure API Integration and enable API Integration.
Click Test API Credentials to verify the connection, then Save.Step 3 — Enable provisioning to app
Under Provisioning → To App, enable:Step 4 — Map attributes
Step 5 — Push groups (optional)
- Go to the Push Groups tab in the Provisioning section.
- Click Push Groups and search for the Okta groups to sync.
- Select the groups and click Save.
Prizm creates matching groups and keeps membership in sync with Okta.Prerequisites
- Azure AD SAML SSO is already configured for Prizm.
- You have Microsoft Entra ID Administrator access.
- You have the Prizm SCIM Callback URL.
Step 1 — Open provisioning in Entra ID
- In the Azure Portal, navigate to Azure Active Directory → Enterprise Applications.
- Open the Prizm enterprise application.
- Go to Provisioning → click Get Started.
Set Provisioning Mode to Automatic, then under Admin Credentials:Click Test Connection — Azure sends a GET to /scim/v2/ServiceProviderConfig. Proceed when successful.Go to Mappings and verify user attribute mappings:For group sync, configure Provision Azure Active Directory Groups mappings similarly.Step 4 — Set provisioning scope
Under Settings, choose:
- Sync only assigned users and groups (recommended) — provisions only users/groups assigned to the Prizm application
- Sync all users and groups — provisions everyone in the directory
Step 5 — Start provisioning
Click Save, then set Provisioning Status to On and click Save again.Azure AD runs an initial sync cycle. Subsequent cycles run automatically every ~40 minutes.Prerequisites
- Ping Identity SAML SSO is already configured for Prizm.
- You have Ping Identity Administrator access.
- You have the Prizm SCIM Callback URL.
Step 1 — Open SCIM provisioning in Ping Identity
- Log in to the PingOne or PingFederate admin console.
- Navigate to Applications and open the Prizm SAML application.
- Go to the Provisioning tab and enable Outbound Provisioning.
Click Test Connection to verify Ping can reach the Prizm SCIM endpoint, then Save.Step 3 — Enable provisioning actions
Step 4 — Map attributes
- Navigate to Group Provisioning in the Provisioning tab.
- Select the groups to sync to Prizm and save.
- Run a Test Provisioning cycle to confirm at least one user and group sync correctly.
- Enable automatic provisioning.
IBM Security Verify supports user provisioning only. Group synchronization is not supported. Users can be assigned to Prizm groups manually after provisioning, or through role mappings configured in Prizm.
Prerequisites
- IBM Security Verify SAML SSO is already configured for Prizm.
- You have IBM Security Verify Administrator access.
- You have the Prizm SCIM Callback URL.
Step 1 — Open provisioning in IBM Security Verify
- Sign in to the IBM Security Verify Admin Console.
- Navigate to Applications and open the Prizm application.
- Go to the Provisioning or Automated User Management section.
Click Test Connection to verify IBM can reach the Prizm SCIM endpoint.Step 3 — Enable provisioning actions
Step 4 — Map attributes
Step 5 — Test and activate
- Run a test provisioning cycle to confirm at least one user syncs and appears in Profile → Organization → Users in Prizm.
- Enable automatic provisioning.
SCIM endpoints
All IdPs use the same Prizm SCIM endpoints:
IBM Security Verify does not call the Groups endpoints. Group endpoints are used by Okta, Azure AD, and Ping Identity only.
