# Provisioning members with SCIM

> Source: https://elaichi.ai/docs/guides/sso/scim-provisioning/

Keep membership in sync with your identity provider over **SCIM 2.0**. When someone is created or deactivated in the directory, Elaichi membership follows — without manual invites for every joiner.

**Where to find it:** **Settings → SSO** → **SCIM provisioning** (and **Group role mappings** below it)

You need **Manage SSO** (`sso:manage`). SCIM and group mappings are **Black plan** features (same gate as SSO).

## What SCIM syncs

| Resource | Behavior |
| --- | --- |
| **Users** | Create and update members from the IdP; **deactivation removes organization membership** |
| **Groups** | Groups appear in Elaichi after the IdP provisions them |
| **Group → role mappings** | Tick Elaichi roles for each SCIM group; members inherit those roles in addition to any roles assigned manually |

SCIM does **not** manage connections, toolboxes, or MCP servers. After deprovisioning, transfer or clean up resources as needed — see [Transferring and offboarding](/guides/connections/transferring-and-offboarding).

## SCIM base URL and token

1. Open **Settings → SSO** and scroll to **SCIM provisioning**.
2. Copy the **SCIM 2.0 base URL** shown for this organization (path ends with `/api/scim/v2`).
3. Choose **Create SCIM token**, name it after the IdP (for example `Okta SCIM`), and create it.
4. **Copy the bearer token now** — it is shown once. Acknowledge storage, then **Done**.
5. In your identity provider, create a SCIM application pointed at that base URL, authenticate with the bearer token, and assign users/groups.

The tokens table lists name, created date, and last used. Revoke stops provisioning immediately; create a replacement token and update the IdP.

:::callout{type="warning"}
Anyone with a SCIM token can provision members and groups in this organization. Store it like a production secret.
:::

## Map groups to roles

```mermaid title="SCIM group → Elaichi roles"
flowchart LR
  IdP["Identity provider"] -->|"SCIM Users + Groups"| Elaichi["Elaichi"]
  Elaichi --> Groups["SCIM groups"]
  Groups --> Mapping["Group role mappings"]
  Mapping --> Roles["Built-in or custom roles"]
  Roles --> Member["Member effective permissions"]
```

1. After the IdP pushes groups, they appear under **Group role mappings**.
2. For each group, tick one or more Elaichi roles (built-in or custom).
3. Clearing all roles removes the mapping for that group.

Members keep manually assigned roles **and** inherit roles from groups they currently belong to. A group with no roles ticked grants nothing via mapping.

If the groups list is empty, confirm the IdP SCIM app is assigned groups and has successfully synced at least once.

## Deactivation

When the IdP deactivates or deletes a user through SCIM, Elaichi **removes their membership** in this organization. Their account may still exist globally if they belong to other orgs. Connections they owned may still need an offboarding pass.

## Good to know

- SCIM tokens are separate from [organization API tokens](/guides/settings/api-tokens).
- New joiners without a group mapping get **Member** unless SSO/domain defaults say otherwise — see [Roles](/guides/members/roles).
- Pair SCIM with [verified domains](/guides/settings/verify-a-domain) and [SSO](/guides/settings/single-sign-on) so login and membership both follow the directory.

## Related

- [Set up single sign-on](/guides/settings/single-sign-on)
- [Roles and permissions](/guides/members/roles)
- [Verify a domain](/guides/settings/verify-a-domain)
- [Transferring and offboarding](/guides/connections/transferring-and-offboarding)
- [Manage billing](/guides/settings/billing)