> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cedarai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM

> Connect your identity provider to Cedar for automated user provisioning.

<Info>
  SCIM (System for Cross-domain Identity Management) automates user provisioning. Your identity provider can automatically create, update, and deactivate users in Cedar.
</Info>

<Note>
  This page covers **creating SCIM mappings in the Admin Portal**. For technical setup in your identity provider, see the [SCIM Setup Guide](/user-docs/sso/scim/overview).
</Note>

<Frame caption="SCIM mappings list">
  <img src="https://mintcdn.com/cedaraiinc/3XL8_nY45kQdoBAs/images/admin/scim-list.png?fit=max&auto=format&n=3XL8_nY45kQdoBAs&q=85&s=fb8eb42ab197f924581a911b27a457a1" alt="SCIM mappings list with create action" width="1440" height="900" data-path="images/admin/scim-list.png" />
</Frame>

## What SCIM does

<CardGroup cols={3}>
  <Card title="Auto-create users" icon="user-plus">
    New employees are added to Cedar automatically
  </Card>

  <Card title="Sync changes" icon="rotate">
    User details stay in sync with your IdP
  </Card>

  <Card title="Auto-deactivate" icon="user-minus">
    Departing employees lose access automatically
  </Card>
</CardGroup>

## When to use SCIM

<Tabs>
  <Tab title="You should use SCIM if..." icon="check">
    * Your organization uses an identity provider (Azure AD, Okta, etc.)
    * You have many users to manage
    * You want automatic provisioning/deprovisioning
    * You need to ensure timely access revocation
  </Tab>

  <Tab title="You might not need SCIM if..." icon="xmark">
    * You have a small number of users
    * You prefer manual user management
    * Your identity provider doesn't support SCIM
  </Tab>
</Tabs>

## Create a SCIM mapping

<Steps>
  <Step title="Get your tenant ID" icon="key">
    In your identity provider (Azure AD, Okta, etc.), find the SCIM tenant ID that will be used for provisioning.
  </Step>

  <Step title="Click New Mapping" icon="plus">
    From the SCIM page, click **New mapping**.
  </Step>

  <Step title="Enter the tenant ID" icon="pen">
    Paste the SCIM tenant ID from your identity provider.
  </Step>

  <Step title="Select the target" icon="bullseye">
    Choose where users should be provisioned:

    * **Organization** — users can access all carriers in the organization
    * **Carrier** — users are limited to a specific carrier

    <Warning>
      Choose carefully. This determines the scope of access for all users provisioned through this mapping.
    </Warning>
  </Step>

  <Step title="Save and configure your IdP" icon="gear">
    Save the mapping, then configure your identity provider to use the provided client ID and secret.
  </Step>
</Steps>

<Frame caption="Associate Tenant dialog for creating a SCIM mapping">
  <img src="https://mintcdn.com/cedaraiinc/3XL8_nY45kQdoBAs/images/admin/create-scim-dialog.png?fit=max&auto=format&n=3XL8_nY45kQdoBAs&q=85&s=5afccd5238cb8925df3618af50bb9156" alt="Associate Tenant dialog with tenant ID and organization/carrier selection" width="1440" height="900" data-path="images/admin/create-scim-dialog.png" />
</Frame>

### Dialog fields explained

| Field            | Required     | Description                                             |
| ---------------- | ------------ | ------------------------------------------------------- |
| **Tenant ID**    | Yes          | The unique identifier from your identity provider       |
| **Organization** | One required | Select if users should have access across all carriers  |
| **Carrier**      | One required | Select if users should be limited to a specific carrier |

<Note>
  You must select either an organization **or** a carrier — not both. This determines the scope of access for all users provisioned through this mapping.
</Note>

## SCIM mapping details

<Frame caption="SCIM mapping configuration">
  <img src="https://mintcdn.com/cedaraiinc/3XL8_nY45kQdoBAs/images/admin/scim-detail.png?fit=max&auto=format&n=3XL8_nY45kQdoBAs&q=85&s=216cd6d9d5d0e46a528e66f6b649ed87" alt="SCIM mapping details" width="1440" height="900" data-path="images/admin/scim-detail.png" />
</Frame>

The detail view shows:

* **Tenant ID** — the identifier from your IdP
* **Organization/Carrier** — where users are provisioned
* **Client ID** — used by your IdP to authenticate
* **Client Secret** — keep this secure (click to copy)
* **Metadata** — creation and update timestamps

## Include deleted mappings

Toggle **Include deleted** to see mappings that were removed or deactivated. This is useful for:

* Auditing previous configurations
* Understanding historical setup
* Restoring accidentally deleted mappings

## Best practices

<AccordionGroup>
  <Accordion title="Secure your credentials" icon="lock" defaultOpen>
    The client secret is only shown once. Copy it immediately and store it securely in your identity provider.
  </Accordion>

  <Accordion title="Test with a small group first" icon="flask">
    Before enabling SCIM for your entire organization, test with a small group of users to ensure provisioning works as expected.
  </Accordion>

  <Accordion title="Monitor initial sync" icon="eye">
    After setting up SCIM, monitor the Users page to ensure users are being created correctly.
  </Accordion>

  <Accordion title="Remember group assignments" icon="users">
    SCIM creates users, but you still need to add them to groups and create bindings for access. Consider using your IdP's group sync features.
  </Accordion>
</AccordionGroup>

## Related: SCIM Setup Guides

<Tip>
  After creating a mapping here, you'll need to configure your identity provider. Use these guides:
</Tip>

<CardGroup cols={2}>
  <Card title="SCIM Technical Overview" href="/user-docs/sso/scim/overview" icon="book">
    Supported SCIM features and protocol details
  </Card>

  <Card title="Azure AD / Entra ID Setup" href="/user-docs/sso/scim/azure" icon="microsoft">
    Step-by-step Azure configuration
  </Card>
</CardGroup>

## Related: Admin Portal

<CardGroup cols={2}>
  <Card title="Users" href="/user-docs/admin/users" icon="user">
    View provisioned users
  </Card>

  <Card title="User Groups" href="/user-docs/admin/user-groups" icon="users">
    Organize provisioned users into teams
  </Card>

  <Card title="Bindings" href="/user-docs/admin/bindings" icon="link">
    Grant access to provisioned users
  </Card>

  <Card title="Activity Log" href="/user-docs/admin/activity-log" icon="clock-rotate-left">
    Monitor provisioning activity
  </Card>
</CardGroup>