SCIM Provisioning

SCIM provisioning is an automated way to create, update, and remove user accounts in business apps. SCIM stands for System for Cross-domain Identity Management. It lets one system, often tied to your HR data, tell other apps who should have an account and what it should contain.

SCIM does not handle sign-in. People often mix it up with single sign-on, but SSO decides how someone logs in, while SCIM decides whether the account exists and what attributes it carries.

What Is SCIM and Where Does It Come From?

SCIM is an open standard from the IETF. The protocol is defined in RFC 7644, published in September 2015, which describes it as an HTTP-based protocol for managing identities across domains. The data model sits in a companion document, RFC 7643.

The goal was to cut the cost and complexity of user management. Without a shared standard, each app can have its own way to add and remove users, so every integration becomes a one-off project. A shared standard lets one connector style work with many apps.

How Does SCIM Provisioning Work?

A SCIM client sends requests to an app's SCIM server over HTTP. The standard defines two main resources, Users and Groups, at endpoints named /Users and /Groups. The client uses familiar methods: POST to create, GET to read, PUT or PATCH to update, and DELETE to remove.

In an HR setup, the HRIS is typically the source of truth. A hire is recorded there. An identity platform then reads the change and pushes it to each connected app by SCIM. The same path carries a department change or a termination.

Exact wiring varies by vendor. Some HRIS products connect straight to apps, and others go through an identity provider in the middle.

Which Attributes Does SCIM Sync?

The core User schema in RFC 7643 includes a unique userName, a name with given and family parts, emails, a title, and an active flag that shows whether the user can log in. Groups hold a display name and a list of members.

An enterprise extension adds fields that matter to HR: employee number, cost center, organization, division, department, and manager. That is how a reporting line can travel from the HR record into another app. Apps may support only some of these fields.

• Identity: user name, display name, and email.
• Job context: title, department, and manager.
• Status: whether the account is active.
• Access: group membership, which an app may tie to roles or permissions.

How Does SCIM Handle Joiners, Movers, and Leavers?

These three events are the heart of the use case. A joiner triggers account creation with the right attributes. A mover, such as someone promoted into another team, triggers an update to title, manager, or groups. A leaver triggers deactivation or deletion.

The leaver step carries the most risk. A common design is to set the active flag to false first, which blocks login but keeps the record. Under the standard, a deleted resource must no longer be returned, though the server may retain the data behind the scenes.

Decide in advance whether you disable or delete, because a deleted account can take its history with it in some apps.

How Is SCIM Different From SSO?

The two answer different questions, so a missing piece shows up in different ways.

You usually want both. SSO without SCIM leaves you creating accounts by hand, and SCIM without SSO leaves people with another password to manage.

What Are the Limits of SCIM?

Not every app supports SCIM, and some vendors reserve it for higher plans. Where it is missing, teams fall back to manual steps or file imports. Even where it exists, a vendor may support only a few attributes.

Group mapping is another snag. A department in the HR system does not automatically match a role in the app, so someone must define the rules. Timing also varies.

Changes may arrive on a schedule instead of instantly, so a leaver's account can stay live for a while. Test it, and learn how your platform handles a failed sync. Our entry on HRIS integration covers the wider issue of connecting HR data to other systems.

How Does HR Cloud Fit Into SCIM Provisioning?

HR Cloud's integrations page lists connections for payroll, applicant tracking, background checks, and single sign-on, and it describes one flow where a recruiting tool syncs hired employees into the HRIS. It does not use the words SCIM or provisioning.

The page also does not describe sync direction for most integrations, how terminations are handled, or whether an API is available. If SCIM matters to you, ask HR Cloud directly whether it is supported.

Discover how our HR solutions streamline onboarding, boost employee engagement, and simplify HR management

Book Your Free Demo

Frequently Asked Questions

Q: What does SCIM stand for?

A: SCIM stands for System for Cross-domain Identity Management. It is an open standard for managing user identities across systems.

Q: What is SCIM provisioning used for?

A: It automatically creates, updates, and removes user accounts in connected apps, so access follows changes in the HR record.

Q: Is SCIM the same as SSO?

A: No. SSO controls how users sign in. SCIM controls whether their accounts exist and what details those accounts hold.

Q: Does SCIM work with every application?

A: No. Each app must offer a SCIM server, and some limit it to certain plans or attributes. Check support before you plan a rollout.

Q: Does SCIM delete accounts when someone leaves?

A: It can deactivate or delete them, depending on how you configure it. Many teams deactivate first to preserve history and block login.

Q: Who owns SCIM setup, HR or IT?

A: IT usually builds and runs the connection. HR owns the source data and the rules for joiners, movers, and leavers.