> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useshipd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Provision members with SCIM

> Connect Okta or Entra ID so your directory adds and removes shipd organization members.

## Overview

In this guide you connect Okta or Entra ID to shipd over SCIM 2.0 (System for Cross-domain Identity Management), so your directory adds people to the organization and removes them when they leave.

**Prerequisites:** an Enterprise plan with SCIM enabled, the `sso.manage` permission (admin or owner), and at least one enabled, domain-verified [SSO provider](/enterprise/sso).

## Why SCIM and SSO

SSO proves who someone is. SCIM decides whether they belong to your shipd organization.

| | SSO only | SSO + SCIM |
| - | - | - |
| Membership created | When the person first signs in (JIT) | When the directory assigns the shipd app |
| Person leaves | Membership stays until an admin removes it | Deactivating them in the directory removes the membership and ends their sessions |
| Unassigned person with a work email | Can join by signing in | Cannot join; SSO does not JIT-join anyone the directory has not provisioned |

## Connect your directory

**1. Copy the tenant URL**

Open **Settings → Security → Directory (SCIM)** and copy **Tenant URL**. It ends in `/api/v1/auth/scim/v2`.

**2. Generate a token**

Click **Generate SCIM token**. Copy the token now; shipd shows it once.

**3. Configure the identity provider**

Create a SCIM 2.0 app in your identity provider, or turn on provisioning for your existing shipd SSO app. Authenticate with the bearer token and map `externalId` to the identity-provider subject, so a later SSO sign-in matches the same person.

```text Okta theme={null}
SCIM connector base URL: {tenant URL}
Authentication: HTTP Header
Authorization: Bearer {token}
Unique identifier: externalId ← Okta user id
```

```text Entra theme={null}
Tenant URL: {tenant URL}
Secret token: {token}
Unique user mapping: externalId ← oid
```

**4. Push users and groups**

Assign people to the app and start provisioning. If you assign through groups, push groups too. Send ordinary User and Group requests; `/Bulk` is not supported, and each request body must be under 1 MiB.

## What the directory controls

Assigning a user creates a SCIM-owned `viewer` membership. Deactivating or removing them removes that membership and ends their sessions. Memberships created manually, or whose role an admin changed, are never deleted by SCIM. Groups are stored but don't grant roles. The full rules are in [SCIM provisioning](/reference/scim#membership).

Owners stay for recovery and must be removed or transferred explicitly. See [Enterprise identity](/reference/enterprise-identity#offboarding).

## Rotate, revoke, or decommission

Rotate, revoke, or decommission the connection from **Settings → Security → Directory (SCIM)**. These controls stay available after a plan downgrade or an SSO provider problem. See [SCIM provisioning](/reference/scim#lifecycle).

Related: [SCIM provisioning](/reference/scim) · [Connect organization single sign-on](/enterprise/sso) · [Organizations and access control](/enterprise/access-control).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.