--- title: "SCIM — Identity Glossary | IDSync" description: "SCIM is an open standard REST/JSON protocol for automatically creating, updating, and deactivating user accounts and groups across SaaS applications from a…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "SCIM", "item": "https://idsync.com/glossary/scim" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/scim", "name": "SCIM", "alternateName": [ "System for Cross-domain Identity Management", "SCIM 2.0", "User provisioning" ], "description": "SCIM is an open standard REST/JSON protocol for automatically creating, updating, and deactivating user accounts and groups across SaaS applications from a central identity source.", "url": "https://idsync.com/glossary/scim", "inDefinedTermSet": "https://idsync.com/glossary" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is SCIM the same as SSO?", "acceptedAnswer": { "@type": "Answer", "text": "No. SSO authenticates users at login. SCIM manages the *existence* of their accounts. You want both." } }, { "@type": "Question", "name": "Why do vendors charge extra for SCIM?", "acceptedAnswer": { "@type": "Answer", "text": "The same \"SSO tax\" dynamic — SCIM is often bundled in the same enterprise tier as SAML. It's controversial and worth negotiating." } }, { "@type": "Question", "name": "What's SCIM 1.1 vs 2.0?", "acceptedAnswer": { "@type": "Answer", "text": "Different schemas and endpoints. SCIM 2.0 is the standard; 1.1 only matters if you're integrating with an older app stuck on it." } } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. SCIM Provisioning # SCIM (System for Cross-domain Identity Management) SCIM is an open standard REST/JSON protocol for automatically creating, updating, and deactivating user accounts and groups across SaaS applications from a central identity source. Last reviewed 3 months ago Key points - SCIM is how user accounts get into (and out of) SaaS apps automatically when HR or the IdP changes. - The current version is SCIM 2.0 (RFCs 7643 and 7644); SCIM 1.1 still exists in older integrations. - Core resources are Users and Groups, with extensible schemas for org-specific attributes. - SCIM is the foundation of Joiner / Mover / Leaver (JML) automation and is critical for fast deprovisioning. - Many SaaS vendors gate SCIM behind enterprise tiers — vet this during procurement. ## What is SCIM? SCIM — System for Cross-domain Identity Management — is an open standard for automating the exchange of user identity information between systems. In plain terms: it's how Okta, Microsoft Entra ID, JumpCloud, or your HRIS tells Slack, GitHub, Zoom, and dozens of other apps that "Alice joined Acme today, here's her email and her groups," and later "Alice left Acme yesterday — disable her account now." SSO gets the user in the door. SCIM makes sure the door — the account — exists in the first place, and gets locked the moment it shouldn't. ## How SCIM works SCIM 2.0 is a RESTful JSON API. The identity source (usually the IdP, sometimes the HRIS) acts as a SCIM **client**, and the downstream app acts as a SCIM **server** exposing endpoints like: - `GET /scim/v2/Users` — list users - `POST /scim/v2/Users` — create a user - `PATCH /scim/v2/Users/{id}` — update attributes or group memberships - `DELETE /scim/v2/Users/{id}` — deactivate / delete The two core resource types are `User` and `Group`. The User schema includes standard attributes (`userName`, `emails`, `active`, `title`, `manager`) and supports extensions for enterprise attributes or app-specific fields. A typical lifecycle looks like: 1. HR adds Alice to Workday with start date and department. 2. The IdP imports Alice from Workday and assigns her to app groups based on role. 3. The IdP issues a SCIM `POST /Users` to Slack creating her account, and `PATCH /Groups` to add her to the right channels. 4. When Alice changes role, the IdP `PATCH`es her group memberships. 5. When Alice leaves, the IdP issues `PATCH active=false` (or DELETE) and her downstream sessions are killed. ## When buyers care about SCIM You need SCIM when: - You have more than ~10 SaaS apps and onboarding involves manual account creation. - Departing employees are leaving active accounts behind (huge audit and security risk). - You're preparing for SOC 2, ISO 27001, or HITRUST — auditors will ask for evidence of automated deprovisioning. - You're running [Joiner / Mover / Leaver](/glossary/joiner-mover-leaver) automation from HR-driven sources. - You're a SaaS vendor whose enterprise buyers are asking how they wire your app into their IdP. ## SCIM vs directory sync vs JIT - **SCIM** — push-based, near-real-time, standardized. The IdP tells the app what changed. - **Directory sync** — typically a scheduled job that pulls users from a directory (AD, LDAP) and reconciles. Older pattern. - **JIT provisioning** — accounts are created the first time the user signs in via SSO. Convenient but doesn't help with _deprovisioning_, which is the part that matters for security. The strongest setup is **SCIM for create/update/deprovision** plus **JIT as a fallback** for users who haven't signed in yet. ## Common pitfalls - **No SCIM = manual deprovisioning.** This is the single biggest source of "ghost" accounts after layoffs. - **Half-implemented SCIM.** Some vendors support `Users` but not `Groups`, or accept `PATCH` but ignore `active=false`. Test the full lifecycle before signing. - **Schema mismatches.** App expects `employeeNumber` in one place, IdP sends it in another. Plan attribute mappings carefully. - **Rate limits.** Large orgs can blow through SCIM endpoint rate limits during bulk events (acquisitions, layoffs). ## FAQ ### Is SCIM the same as SSO? No. SSO authenticates users at login. SCIM manages the _existence_ of their accounts. You want both. ### Why do vendors charge extra for SCIM? The same "SSO tax" dynamic — SCIM is often bundled in the same enterprise tier as SAML. It's controversial and worth negotiating. ### What's SCIM 1.1 vs 2.0? Different schemas and endpoints. SCIM 2.0 is the standard; 1.1 only matters if you're integrating with an older app stuck on it. ## Standards & references - [RFC 7643 — SCIM Core Schema](https://datatracker.ietf.org/doc/html/rfc7643) - [RFC 7644 — SCIM Protocol](https://datatracker.ietf.org/doc/html/rfc7644) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [scim](/directory/category/scim)[iga](/directory/category/iga)[iam platforms](/directory/category/iam-platforms) ### Related terms [single sign on](/glossary/single-sign-on)[joiner mover leaver](/glossary/joiner-mover-leaver)[iga](/glossary/iga)[directory sync](/glossary/directory-sync) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the scim category. [Explore tools](/directory/category/scim) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.