SCIM is the System for Cross-domain Identity Management, an open IETF standard (RFC 7643 for the schema, RFC 7644 for the protocol) that lets an identity provider automatically create, update and remove user accounts and groups in applications through a standard REST API.

What does SCIM stand for?

SCIM stands for System for Cross-domain Identity Management. The current version is SCIM 2.0, published by the IETF in 2015 as RFC 7643 and RFC 7644.

What is SCIM provisioning?

SCIM provisioning is the automated creation, update and deactivation of accounts in an application, driven by an identity provider such as Okta or Microsoft Entra ID. When someone joins, changes role or leaves, the identity provider sends SCIM requests to the application's /Users and /Groups endpoints, so accounts follow the HR record without tickets.

SCIM 2.0 is the current and only widely deployed version of SCIM, defined by RFC 7643 and RFC 7644 in 2015. There is no SCIM 3.0. RFC 9865 (October 2025) added cursor-based pagination and RFC 9967 (May 2026) added a SCIM profile for security event tokens, both as updates to SCIM 2.0.

What is a SCIM integration?

A SCIM integration is a configured connection between an identity provider (the SCIM client) and an application that exposes a SCIM endpoint (the SCIM server), with credentials, attribute mappings and scoping rules that decide which users and groups are pushed.

What is the difference between SAML and SCIM?

SAML (or OIDC) handles authentication: proving who someone is when they sign in. SCIM handles provisioning: making sure the account exists with the right attributes and groups, and is deactivated when they leave. Enterprise buyers usually require both.

Does SCIM deprovisioning revoke active sessions?

Not by itself. A SCIM PATCH setting active to false tells the application to disable the account, but existing sessions, API tokens and OAuth grants depend on how the application handles that change. Test it, and revoke tokens separately where the application does not.

What are the best SCIM provisioning tools?

For workforce provisioning, the identity provider is usually the SCIM client: Okta, Microsoft Entra ID, JumpCloud or OneLogin. For B2B SaaS vendors who need to offer SCIM to their customers, SWI's SSO and SCIM ranking lists WorkOS, SSOJet, Auth0, FusionAuth and Keycloak as its top five.

What Is SCIM? SCIM Provisioning and SCIM 2.0 Explained

SCIM (System for Cross-domain Identity Management) is the open IETF standard for SCIM provisioning: an identity provider uses it to create, update and remove user accounts and groups in applications automatically. SCIM 2.0 is defined by RFC 7643 (the schema) and RFC 7644 (the REST protocol). When HR adds an employee or an admin assigns an app, SCIM pushes the change, and when someone leaves, it disables the account without a ticket.

Why it matters

Manual account management is slow and leaky. The biggest risk is deprovisioning: accounts that linger after someone leaves become orphaned accounts and attacker targets (orphaned account abuse). A former Cash App employee downloaded customer reports after leaving; Colonial Pipeline was entered through a legacy VPN account the company believed was unused. SCIM closes that gap by automating the joiner-mover-leaver lifecycle for every application that supports it.

How SCIM works

The identity provider is the SCIM client. The application exposes a SCIM server endpoint and accepts JSON over HTTPS.

Operation	HTTP request	Typical trigger
Create user	`POST /Users`	User assigned to the app
Look up before create	`GET /Users?filter=userName eq "..."`	Matching to avoid duplicates
Update attributes	`PATCH /Users/{id}`	Department, manager or name change
Disable user	`PATCH` with `active: false`	Leaver, unassignment, out of scope
Delete user	`DELETE /Users/{id}`	Hard delete in the source
Manage group membership	`PATCH /Groups/{id}`	Group add or remove
Discover features	`GET /ServiceProviderConfig`, `/Schemas`, `/ResourceTypes`	Setup

Microsoft Entra ID's provisioning service is a good worked example. It runs an initial cycle and then back-to-back incremental cycles. When a user is unassigned, disabled or soft-deleted, it sends an update setting active to false; Entra hard-deletes users 30 days after a soft delete, and only then sends a DELETE. It cannot read nested groups, only direct members of an assigned group. If most calls fail, for example because the app's credentials expired, the job enters quarantine, cycles slow to once a day, and after four weeks the job is disabled. Each of those behaviors is a place where a leaver can keep access.

Standard status in 2026

SCIM 2.0 has been stable since 2015 and there is no SCIM 3.0. The IETF has extended it rather than replaced it: RFC 9865 (October 2025) adds cursor-based pagination for large directories, and RFC 9967 (May 2026) adds a SCIM profile for security event tokens. See the SCIM 2.0 standard page and the SCIM glossary entry.

SCIM vs SAML vs OIDC vs JIT provisioning

	SCIM	SAML / OIDC	Just-in-time (JIT) provisioning
Job	Account lifecycle	Sign-in	Create account at first sign-in
Creates accounts before first login	Yes	No	No
Updates attributes and groups	Yes, anytime	Only at sign-in	Only at sign-in
Deprovisions leavers	Yes	No	No
Standard	RFC 7643, RFC 7644	SAML 2.0, OpenID Connect	Vendor-specific

JIT provisioning is often sold as an alternative to SCIM. It is not one, because it never removes anyone.

Where SCIM implementations break

The standard is straightforward; implementations vary enough that "supports SCIM 2.0" tells you less than it should:

Deactivation versus deletion. RFC 7644 lets a server choose not to permanently delete a resource as long as it returns 404 afterwards, and some apps ignore active: false. Test that a disabled leaver cannot sign in.
Sessions and tokens survive. Disabling the account may not revoke API tokens or OAuth grants. At CrowdSec, a departing engineer's account was left open and its OAuth token later used to copy about 170 private repositories.
Group handling. Group sync is the least consistent part. Check whether groups push at all, whether nested groups flatten, and what happens on rename.
PATCH support. Apps that only accept full PUT replacement drop attributes the IdP did not send.
Pagination and filtering. Fine at 500 users, a real problem at 50,000; RFC 9865 cursors help where implemented.
Attribute mapping. Custom attributes and enterprise extensions are where most integration time goes.
Silent failure. A quarantined or disabled provisioning job stops deprovisioning without anyone noticing. Alert on it.

The long tail is the real work

SCIM covers the applications that support it. The residual is the on-premises tool, the appliance with a local user database, the SaaS product bought on a corporate card. Those are where orphaned accounts accumulate; an IGA platform or regular reconciliation covers them. Reconcile every account against an authoritative owner at least once, and use the secure offboarding checklist. Many vendors also gate SCIM behind enterprise tiers, the SSO tax.

If you sell B2B SaaS

SCIM plus SAML is a procurement gate above a certain deal size. Self-serve configuration matters as much as the protocol: every connection your support team configures by hand is a cost that scales with your customer count. Published pricing for adding it, from the Identity Pricing Transparency Index 2026, checked October 30, 2026:

Vendor	SSO and SCIM pricing
WorkOS	125 dollars per connection (1 to 15)
Stytch (Twilio since November 2025)	125 dollars per connection beyond 5
SSOJet	59 dollars per connection per month annual, two-connection minimum; SSO and SCIM count as two
Frontegg	Free tier includes 5 SSO/SCIM connections

Compare the field in best SSO and SCIM platforms for B2B SaaS and the top SCIM provisioning tools, alongside Auth0, FusionAuth and Keycloak.

Where to start

Workforce teams: SCIM is usually configured in Okta, Microsoft Entra ID or JumpCloud; start with the SCIM provisioning implementation guide and browse IGA platforms and workforce IAM.