SCIM provisioning overview

SCIM (System for Cross-domain Identity Management) is an open standard that lets one system keep the users and groups of another up to date automatically. BreezeAuth implements SCIM 2.0 as a provider: another system, such as your HR platform or the identity directory where your company already maintains its people, connects to BreezeAuth and creates, updates and removes users and groups for you.

This is often called inbound provisioning: changes flow into BreezeAuth. When someone is hired, the provisioning system creates their user. When they change teams, it updates their groups. When they leave, it deactivates them. Nobody has to repeat those changes by hand in the admin console.

How it works

1. You create a service userIn the admin console, a service user with the SCIM Provisioner role, and a credential for it.
2. You configure the provisioning systemWith the SCIM base URL of your organization and the credential.
3. The system calls the SCIM APIIt obtains an access token and sends standard SCIM requests to the /Users and /Groups endpoints.
4. BreezeAuth applies the changesExactly as if an administrator had made them: same rules, same e-mails, same audit trail.

There is no SCIM screen in the admin console. SCIM is an additional interface of the BreezeAuth API, used only by service users. Your part in the admin console is to create the service user and its credential, and to check the results: provisioned users and groups appear under Users and Groups like any others. Step-by-step instructions are in Set up SCIM provisioning.

What the provisioning system can do

SCIM resource	In BreezeAuth	The provisioning system can
User	A user of your organization	Create, read, update, deactivate and delete users. See Provision users.
Group	A group of your organization	Create, read, rename and delete groups, and add or remove their members. See Provision groups.

Everything else stays in the admin console. Through SCIM, a provisioning system can’t:

• give or change administrative roles, or change or delete a user with the Owner role;
• see or change service users;
• assign applications to users or groups. Give each provisioned group access to its applications in the admin console, once: new members get that access automatically;
• set or change passwords, MFA or sessions.

The same rules as the admin console

A change made through SCIM follows the same rules as the same change made by an administrator:

• Account types. A user whose e-mail is on one of your verified domains is created as a managed user. Anyone else is invited as a guest, receives an invitation e-mail and must accept it. See Managed and guest users.
• Deleting. Deleting a managed user also deletes their BreezeAuth account. Deleting a group requires it to have no members.
• Audit and webhooks. Every change is recorded in the Audit Logs, with the service user as the actor, and is sent to your webhooks like any other change.

Supported SCIM features

Feature	Supported
Users and groups: create, read, replace (PUT), delete	Yes
Partial updates (PATCH)	Yes
Enterprise User extension (employee number, department…)	Yes
Nested groups (a group as a member of another group)	Yes
Filtering	Equality only: userName, externalId and displayName
Pagination, attributes and excludedAttributes	Yes
Discovery (ServiceProviderConfig, ResourceTypes, Schemas)	Yes
Bulk operations, sorting, ETags, password changes	No

The technical details are in the SCIM API reference.

Next steps

• Set up SCIM provisioning for your organization.
• Learn how users and groups are provisioned.
• Share the SCIM API reference with the developers or the team configuring the provisioning system.