SCIM provisioning

Let your identity provider create and deactivate UnitX members automatically with a SCIM credential.

SCIM is the standard identity providers use to keep an application’s users in step with your directory. With SCIM set up, your identity provider creates UnitX members when people join and deactivates them when they leave, so nobody has to remember to do it by hand.

Who can set it up#

Permissions

scim.manage

Separate from member.remove and sso.manage on purpose: a provisioning connection should not get broader access than it needs. The 3. Provisioning sub-tab only appears for people who hold it.

What a SCIM credential can do#

A provisioning credential can only manage membership. It cannot read or change projects, documents, customers or anything else in your organization. Through it, your identity provider can:

list, look up, create and update users;
deactivate a user, either by marking them inactive or by deleting them;
read your organization’s roles, which are presented to the provider as groups.

Set up provisioning#

Open the Provisioning sub-tab
Go to SettingsSingle sign-on3. Provisioning.
Create a credential
Enter a Credential name that says where it is used, such as “Okta production”, and choose Create credential.
Copy the token now
The token appears under Copy this now — it is not shown again. Copy it before choosing Done; there is no way to read it back later.
Configure your provider
In your identity provider’s SCIM settings, enter the two URLs shown under Give your provider these endpoints (ending in /scim/v2/Users and /scim/v2/Groups) and paste the token as the bearer token.
Check it is being used
Once your provider syncs, the credential shows when it was last used instead of never used.

Tip

Set up single sign-on first. Provisioning is most useful once people can sign in with the identity provider that is creating their accounts.

What happens to members#

In your provider	In UnitX
A person is assigned to the UnitX application	They become a member with the Member role. Their account has no UnitX password — they sign in through your provider. Change their role on the Members tab if they need something else.
A person’s details change	The member’s details are updated.
A person is deactivated or unassigned	Their membership is deactivated, not deleted. Their history, and anything they own, stays intact.

Revoke a credential#

Choose Revoke next to a credential. It stops working immediately and its badge changes from Active to Revoked. If a token is lost or exposed, revoke it, create a new credential and update your provider.

Each credential in the list shows the first characters of its token, so you can tell which one a provider is using, and when it was last used.

Can I see the token again?

No. It is shown once. If it is lost, revoke that credential and create another.

Can I have more than one credential?

Yes — for example one per environment or per provider. Name them so they can be told apart.

Does SCIM assign roles from groups?

New members start as Member. Roles are shown to your provider as groups so it can read them, but role changes are made in UnitX on the Members tab.