> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Integration

> Automated user and group lifecycle management in Prizm — configure SCIM provisioning for Okta, Azure AD, Ping Identity, and IBM Security Verify.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "SCIM Integration",
            "description": "Automated user and group lifecycle management in Prizm - configure SCIM provisioning for Okta, Azure AD, Ping Identity, and IBM Security Verify.",
            "url": "https://docs.dqlabs.ai/security/sso/scim",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning. When SCIM is configured, your Identity Provider (IdP) automatically creates, updates, deactivates, and deletes Prizm user accounts whenever changes are made in your directory — no manual user management required.

## How it works

1. Prizm exposes a **SCIM Callback URL** visible under **Profile → Organization → SSO/SAML**.
2. You configure your IdP to send provisioning requests to that URL using a bearer token for authentication.
3. Whenever a user is added, changed, or removed in your IdP, it pushes a SCIM request to Prizm.
4. Prizm applies the change — creating the account, updating the profile, or deactivating access.

## Supported providers

| Provider                              | User Provisioning | Group Sync   |
| :------------------------------------ | :---------------- | :----------- |
| **Okta**                              | ✅                 | ✅            |
| **Azure Active Directory / Entra ID** | ✅                 | ✅            |
| **Ping Identity**                     | ✅                 | ✅            |
| **IBM Security Verify**               | ✅                 | ❌ Users only |

<Note>
  IBM Security Verify supports user provisioning only. Group synchronization is not available for IBM. Use Okta, Azure AD, or Ping Identity if group-based access management is required.
</Note>

## What SCIM manages

| Entity               | Operations                         | Providers                     |
| :------------------- | :--------------------------------- | :---------------------------- |
| **Users**            | Create, Update, Deactivate, Delete | All                           |
| **Groups**           | Create, Update, Delete             | Okta, Azure AD, Ping Identity |
| **Group membership** | Add / Remove user                  | Okta, Azure AD, Ping Identity |

## Prerequisites

* SAML SSO must already be configured in Prizm for your IdP before enabling SCIM.
* You need admin access to both Prizm (**Profile → Organization → SSO/SAML**) and your IdP.
* A static bearer token is required for the IdP to authenticate to Prizm's SCIM endpoint.

## Finding the SCIM Callback URL

1. In Prizm, navigate to **Profile → Organization → SSO/SAML**.
2. Locate the **SCIM Callback URL** field (read-only).
3. Copy this URL — paste it into your IdP's SCIM provisioning configuration as the SCIM Base URL or Tenant URL.

***

## Setup by provider

<Tabs>
  <Tab title="Okta">
    ### Prerequisites

    * Okta SAML SSO is already configured for Prizm.
    * You have Okta Administrator access.
    * You have the Prizm SCIM Callback URL.

    ### Step 1 — Open SCIM provisioning in Okta

    1. In the Okta Admin Console, navigate to **Applications** and open the Prizm SAML application.
    2. Go to the **Provisioning** tab → **Integration** section.
    3. Click **Configure API Integration** and enable **API Integration**.

    ### Step 2 — Configure the SCIM endpoint

    | Field                                 | Value                                 |
    | :------------------------------------ | :------------------------------------ |
    | **SCIM connector base URL**           | Prizm SCIM Callback URL               |
    | **Unique identifier field for users** | `email`                               |
    | **Supported provisioning actions**    | Import Users, Push Users, Push Groups |
    | **Authentication Mode**               | HTTP Header                           |
    | **Authorization**                     | `Bearer <your-static-token>`          |

    Click **Test API Credentials** to verify the connection, then **Save**.

    ### Step 3 — Enable provisioning to app

    Under **Provisioning → To App**, enable:

    | Setting                    | Effect                                                                      |
    | :------------------------- | :-------------------------------------------------------------------------- |
    | **Create Users**           | Automatically creates Prizm accounts for Okta users assigned to the app     |
    | **Update User Attributes** | Syncs profile changes from Okta to Prizm                                    |
    | **Deactivate Users**       | Deactivates Prizm accounts when a user is unassigned or deactivated in Okta |

    ### Step 4 — Map attributes

    | Okta attribute                 | SCIM attribute                 |
    | :----------------------------- | :----------------------------- |
    | `userPrincipalName`            | `userName`                     |
    | `givenName` / `user.firstName` | `name.givenName`               |
    | `surname` / `user.lastName`    | `name.familyName`              |
    | `email` / `user.email`         | `emails[type eq "work"].value` |

    ### Step 5 — Push groups (optional)

    1. Go to the **Push Groups** tab in the Provisioning section.
    2. Click **Push Groups** and search for the Okta groups to sync.
    3. Select the groups and click **Save**.

    Prizm creates matching groups and keeps membership in sync with Okta.

    <Frame />
  </Tab>

  <Tab title="Azure AD / Entra ID">
    ### Prerequisites

    * Azure AD SAML SSO is already configured for Prizm.
    * You have Microsoft Entra ID Administrator access.
    * You have the Prizm SCIM Callback URL.

    ### Step 1 — Open provisioning in Entra ID

    1. In the Azure Portal, navigate to **Azure Active Directory → Enterprise Applications**.
    2. Open the Prizm enterprise application.
    3. Go to **Provisioning** → click **Get Started**.

    ### Step 2 — Configure the SCIM endpoint

    Set **Provisioning Mode** to **Automatic**, then under **Admin Credentials**:

    | Field            | Value                                               |
    | :--------------- | :-------------------------------------------------- |
    | **Tenant URL**   | Prizm SCIM Callback URL (must end with `/scim/v2/`) |
    | **Secret Token** | Static bearer token generated in Prizm              |

    Click **Test Connection** — Azure sends a GET to `/scim/v2/ServiceProviderConfig`. Proceed when successful.

    <Frame />

    ### Step 3 — Configure attribute mappings

    Go to **Mappings** and verify user attribute mappings:

    | Azure AD attribute  | SCIM attribute                                                          |
    | :------------------ | :---------------------------------------------------------------------- |
    | `userPrincipalName` | `userName`                                                              |
    | `givenName`         | `name.givenName`                                                        |
    | `surname`           | `name.familyName`                                                       |
    | `mail`              | `emails[type eq "work"].value`                                          |
    | `department`        | `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department` |

    For group sync, configure **Provision Azure Active Directory Groups** mappings similarly.

    ### Step 4 — Set provisioning scope

    Under **Settings**, choose:

    * **Sync only assigned users and groups** (recommended) — provisions only users/groups assigned to the Prizm application
    * **Sync all users and groups** — provisions everyone in the directory

    ### Step 5 — Start provisioning

    Click **Save**, then set **Provisioning Status** to **On** and click **Save** again.

    Azure AD runs an initial sync cycle. Subsequent cycles run automatically every \~40 minutes.
  </Tab>

  <Tab title="Ping Identity">
    ### Prerequisites

    * Ping Identity SAML SSO is already configured for Prizm.
    * You have Ping Identity Administrator access.
    * You have the Prizm SCIM Callback URL.

    ### Step 1 — Open SCIM provisioning in Ping Identity

    1. Log in to the PingOne or PingFederate admin console.
    2. Navigate to **Applications** and open the Prizm SAML application.
    3. Go to the **Provisioning** tab and enable **Outbound Provisioning**.

    ### Step 2 — Configure the SCIM endpoint

    | Field                     | Value                           |
    | :------------------------ | :------------------------------ |
    | **SCIM Base URL**         | Prizm SCIM Callback URL         |
    | **Authentication Method** | Bearer Token                    |
    | **Bearer Token**          | Static token generated in Prizm |

    Click **Test Connection** to verify Ping can reach the Prizm SCIM endpoint, then **Save**.

    <Frame />

    ### Step 3 — Enable provisioning actions

    | Action                     | Description                                                        |
    | :------------------------- | :----------------------------------------------------------------- |
    | **Create Users**           | Automatically creates Prizm accounts for users assigned to the app |
    | **Update User Attributes** | Syncs profile changes from Ping to Prizm                           |
    | **Deactivate Users**       | Deactivates Prizm accounts when users are deprovisioned in Ping    |
    | **Push Groups**            | Syncs Ping groups to Prizm                                         |

    ### Step 4 — Map attributes

    | Ping attribute            | SCIM attribute                 |
    | :------------------------ | :----------------------------- |
    | `username`                | `userName`                     |
    | `given_name` / Given Name | `name.givenName`               |
    | `family_name` / Surname   | `name.familyName`              |
    | `email` / Email Address   | `emails[type eq "work"].value` |
    | `active`                  | `active`                       |

    ### Step 5 — Configure group provisioning and activate

    1. Navigate to **Group Provisioning** in the Provisioning tab.
    2. Select the groups to sync to Prizm and save.
    3. Run a **Test Provisioning** cycle to confirm at least one user and group sync correctly.
    4. Enable automatic provisioning.
  </Tab>

  <Tab title="IBM Security Verify">
    <Warning>
      IBM Security Verify supports **user provisioning only**. Group synchronization is not supported. Users can be assigned to Prizm groups manually after provisioning, or through role mappings configured in Prizm.
    </Warning>

    ### Prerequisites

    * IBM Security Verify SAML SSO is already configured for Prizm.
    * You have IBM Security Verify Administrator access.
    * You have the Prizm SCIM Callback URL.

    ### Step 1 — Open provisioning in IBM Security Verify

    1. Sign in to the IBM Security Verify Admin Console.
    2. Navigate to **Applications** and open the Prizm application.
    3. Go to the **Provisioning** or **Automated User Management** section.

    ### Step 2 — Configure the SCIM endpoint

    | Field                     | Value                           |
    | :------------------------ | :------------------------------ |
    | **SCIM Base URL**         | Prizm SCIM Callback URL         |
    | **Authentication Method** | Bearer Token                    |
    | **Authentication Token**  | Static token generated in Prizm |

    Click **Test Connection** to verify IBM can reach the Prizm SCIM endpoint.

    <Frame />

    ### Step 3 — Enable provisioning actions

    | Action                     | Supported | Description                                                    |
    | :------------------------- | :-------- | :------------------------------------------------------------- |
    | **Create Users**           | ✅         | Creates Prizm accounts for provisioned users                   |
    | **Update User Attributes** | ✅         | Syncs first name, last name, and email from IBM to Prizm       |
    | **Deactivate Users**       | ✅         | Deactivates Prizm accounts when users are deprovisioned in IBM |
    | **Push Groups**            | ❌         | Not supported by IBM Security Verify                           |

    ### Step 4 — Map attributes

    | IBM attribute | SCIM attribute                                |
    | :------------ | :-------------------------------------------- |
    | `email`       | `userName` and `emails[type eq "work"].value` |
    | `given_name`  | `name.givenName`                              |
    | `family_name` | `name.familyName`                             |
    | `active`      | `active`                                      |

    ### Step 5 — Test and activate

    1. Run a test provisioning cycle to confirm at least one user syncs and appears in **Profile → Organization → Users** in Prizm.
    2. Enable automatic provisioning.
  </Tab>
</Tabs>

***

## SCIM endpoints

All IdPs use the same Prizm SCIM endpoints:

| Operation                | Method         | Endpoint                         |
| :----------------------- | :------------- | :------------------------------- |
| List users               | GET            | `/scim/v2/Users`                 |
| Get user                 | GET            | `/scim/v2/Users/{id}`            |
| Create user              | POST           | `/scim/v2/Users`                 |
| Update user              | PUT / PATCH    | `/scim/v2/Users/{id}`            |
| Deactivate / delete user | DELETE / PATCH | `/scim/v2/Users/{id}`            |
| List groups              | GET            | `/scim/v2/Groups`                |
| Create group             | POST           | `/scim/v2/Groups`                |
| Update group             | PUT / PATCH    | `/scim/v2/Groups/{id}`           |
| Delete group             | DELETE         | `/scim/v2/Groups/{id}`           |
| Service discovery        | GET            | `/scim/v2/ServiceProviderConfig` |

<Note>
  IBM Security Verify does not call the Groups endpoints. Group endpoints are used by Okta, Azure AD, and Ping Identity only.
</Note>