SCIM
SCIM (System for Cross-domain Identity Management) is the IETF standard, RFC 7643 (schema) and RFC 7644 (protocol), that lets an identity provider create, update and remove user and group accounts in applications through a REST API. Two later RFCs extend it: RFC 9865 (2025) adds cursor-based pagination and RFC 9967 (2026) adds a profile for security event tokens.
SCIM is the reason enterprise buyers can turn on a SaaS tool without building a custom sync, and it is a hard requirement in most B2B procurement above a certain size. Implementations vary widely in practice: group handling, soft delete versus hard delete, and filtering support are where integrations break. Support PATCH, honor active: false as a deactivation, and paginate correctly.
What SCIM does and does not do
| SCIM does | SCIM does not |
|---|---|
| Define a standard JSON schema for User, Group and Enterprise User resources (RFC 7643) | Sign users in. Authentication and SSO are SAML or OIDC |
| Define REST create, read, replace, PATCH, delete, filter and bulk operations (RFC 7644); PATCH and bulk are optional for servers | Define its own client authentication. RFC 7644 relies on TLS plus standard HTTP schemes such as OAuth 2.0 bearer tokens, and says basic authentication should be avoided |
Let clients discover server capabilities through /ServiceProviderConfig, /ResourceTypes and /Schemas |
Decide what a user may do inside the app. Roles and entitlements beyond group membership are app-specific |
| Automate deprovisioning when someone leaves | Guarantee a hard delete. RFC 7644 lets a server keep a deleted resource as long as it returns 404 and omits it from queries |
| Work for any app that exposes a SCIM endpoint, so one connector serves many apps | Make two implementations interoperable by itself. Custom extensions and partial PATCH support differ per vendor |
See also: SCIM 2.0 standard, what is SCIM, provisioning, set up SCIM provisioning recipe, SCIM provisioning tools
Related on Start with Identity
- GlossaryLDAP
Lightweight Directory Access Protocol. A protocol for querying and modifying a hierarchical directory of entries, each identified by a distinguished name. Used
- GlossaryIGA
Identity Governance and Administration. The discipline of managing who has access to what, why, and for how long. Covers access certification, segregation of du
- GlossaryJoiner-Mover-Leaver (JML)
The joiner-mover-leaver (JML) process is the set of identity changes triggered when someone joins an organization (joiner: create accounts and grant birthright
- RankingBest Enterprise SSO & SCIM Platforms for B2B SaaS: Top 5
The best enterprise SSO and SCIM platforms for B2B SaaS in 2026: WorkOS, SSOJet, Auth0, FusionAuth, and Keycloak, ranked for teams that already have core auth a
- ExpertEditor, SCIM Protocol (RFC 7644)
Phil Hunt is the editor of RFC 7644, the SCIM protocol, published in 2015 with co-authors from SailPoint, Cisco, Nexus, and Salesforce while he was at Oracle. H
- ArticleEnterprise Readiness for B2B SaaS: SSO, SCIM, and Audit Logs
The identity features that turn a B2B SaaS product into one enterprises will buy: SAML and OIDC single sign-on, SCIM provisioning, audit logs, role-based access