Overview
In this guide you connect Okta or Entra ID to shipd over SCIM 2.0 (System for Cross-domain Identity Management), so your directory adds people to the organization and removes them when they leave. Prerequisites: an Enterprise plan with SCIM enabled, thesso.manage permission (admin or owner), and at least one enabled, domain-verified SSO provider.
Why SCIM and SSO
SSO proves who someone is. SCIM decides whether they belong to your shipd organization.Connect your directory
1
Copy the tenant URL
Open Settings → Security → Directory (SCIM) and copy Tenant URL. It ends in
/api/v1/auth/scim/v2.2
Generate a token
Click Generate SCIM token. Copy the token now; shipd shows it once.
3
Configure the identity provider
Create a SCIM 2.0 app in your identity provider, or turn on provisioning for your existing shipd SSO app. Authenticate with the bearer token and map
externalId to the identity-provider subject, so a later SSO sign-in matches the same person.4
Push users and groups
Assign people to the app and start provisioning. If you assign through groups, push groups too. Send ordinary User and Group requests;
/Bulk is not supported, and each request body must be under 1 MiB.What the directory controls
Assigning a user creates a SCIM-ownedviewer membership. Deactivating or removing them removes that membership and ends their sessions. Memberships created manually, or whose role an admin changed, are never deleted by SCIM. Groups are stored but don’t grant roles. The full rules are in SCIM provisioning.
Owners stay for recovery and must be removed or transferred explicitly. See Enterprise identity.