On this page
What does SCIM do?
SCIM is an open standard for user provisioning across systems. Its full name is System for Cross-domain Identity Management, and its job is to keep the account list in one system matching the account list in another.
Sign-on and provisioning are different problems, and it helps to keep them apart. SAML or OIDC decides whether a person can get in right now. SCIM decides whether an account exists there at all.
How does SCIM work?
SCIM is a REST API with JSON bodies and a defined schema for users and groups. The identity provider is the source of truth and pushes each change to the connected applications, which apply it to their own directories.
The schema is what makes this a standard rather than one more integration. Both sides already agree on what a user looks like, so nobody writes a field mapping for userName.
- /Users and /Groups: the standard resource endpoints.
- POST creates, PUT replaces, and PATCH applies a partial update.
- DELETE removes an account, and many systems deactivate instead of destroying.
- A filter query locates an existing resource, commonly by userName or externalId.
- Core and enterprise user schemas define the attribute names both sides expect.
Why does SCIM matter?
The security case is deprovisioning, not provisioning. Creating an account late is an annoyance. Leaving one alive after somebody leaves is an open door that nobody is watching.
Manual offboarding fails quietly and predictably. Someone misses an application, the checklist is out of date, and the account stays valid for months. SCIM removes the human step from the part of the lifecycle where humans are least reliable.
Leavers lose access in minutes
One change at the identity provider reaches every connected application, so there is no window in which a former employee still holds a live account somewhere.
Joiners start with the right access
Accounts and group membership are created before the first day rather than requested afterwards. That is also how you stop over-broad access being granted for speed.
Access reviews have something to review
When the directory and the applications agree, an audit becomes a report instead of an investigation.
How does SenseCrypt use SCIM?
SenseCrypt is a passwordless identity provider (IdP) from Seventh Sense with SCIM 2.0 support, so the account lifecycle runs on the same platform as the sign-in. You provision from your source directory, and those same records govern face enrollment and group membership.
Provisioning and authorization are connected here on purpose. A user who belongs to no permitted group does not get in, because the group gate at sign-in is default-closed.
Users and groups over SCIM 2.0
Create, update, and deactivate accounts through the standard endpoints, with group membership carried across.
Groups decide who gets through the door
Membership is not only a label. SenseCrypt refuses a sign-in when no permitted group matches, so a group change takes effect at the door rather than downstream.
No second directory to reconcile
The account SCIM creates is the account that enrolls a face and carries the roles. There is no separate biometric directory to keep in step with your source of truth.
Frequently asked questions
What does SCIM stand for?
SCIM stands for System for Cross-domain Identity Management. It is an open standard for user provisioning.
What is SCIM used for?
SCIM keeps user accounts in sync between systems. It automates account creation, updates, and removal.
Does SenseCrypt support SCIM 2.0?
Yes. SenseCrypt supports SCIM 2.0 for automatic user provisioning. It also gives audit logs.
Related