User Provisioning with SCIM

If your organization uses an Identity provider to manage your employees’ access to tools and services, you may be able to take advantage of your provider's “Provisioning” feature to automatically grant your users access to OpsLevel.

The provisioning integration between OpsLevel and your identity provider is built around an industry-standard protocol known as SCIM (System for Cross-domain Identity Management). This guide will outline OpsLevel's support for SCIM. For more details on configuring Provisioning for specific tools, check out our specific guides:

Features

The following provisioning features are supported by OpsLevel today:

Push Users: Users in your identity provider that are assigned to the OpsLevel application are automatically added as users in OpsLevel
Update User Attributes: When user attributes are updated in the identity provider, they will be updated in OpsLevel.
Deactivate Users: When users are deactivated in the identity provider, they will be set to ‘Deactivated’ within OpsLevel – which prevents the user from logging into OpsLevel.

Requirements

SCIM-based user provisioning is available to all customers of OpsLevel at this time.

SCIM Details

OpsLevel supports the SCIM v2 User provisioning operations.

FAQs

Can SCIM manage users who were manually invited or created through SSO?

Yes. Once SCIM is set up, assign those users to the OpsLevel application in your identity provider. It matches them to their existing OpsLevel accounts by email, and SCIM then manages their profile and active status. They keep their original “Provisioned by” label (for example, SSO); only users SCIM creates are labelled SCIM.

When SCIM provisioning is enabled, can users still log in via SSO as usual?

Yes. SCIM and JIT provisioning work together. Users who aren’t in the SCIM-provisioned groups can still log in via SSO and be provisioned through JIT.

Does a deactivated user still take up one of our licensed seats?

No. When a user is removed from the SCIM-provisioned group, SCIM deactivates them in OpsLevel, and deactivated users don’t count toward your seat total.

Will enabling SCIM deactivate or delete existing JIT users who aren’t in the SCIM groups?

No. Enabling SCIM leaves existing JIT users untouched. Because SCIM doesn’t track these users, offboarding them requires manual deactivation or deletion in OpsLevel.

Does SCIM delete users?

When we receive a delete command from SCIM, OpsLevel only deactivates users, not delete.

Can I delete SSO users so SCIM re-creates them as SCIM users?

You can, but we don’t recommend it. Deleting a user in OpsLevel is permanent. If SCIM provisions them again, they come back as a new user labelled SCIM. Their previous contact details, tags, notification subscriptions, and any team memberships not managed through SCIM groups are not restored, and API tokens they own are left without an owner.