User Provisioning with SCIM
Provision users automatically from your identity provider to quickly build your catalog and keep your users fresh.
If your organization uses an Identity provider to manage your employees’ access to tools and services, you may be able to take advantage of your provider's “Provisioning” feature to automatically grant your users access to OpsLevel.
The provisioning integration between OpsLevel and your identity provider is built around an industry-standard protocol known as SCIM (System for Cross-domain Identity Management). This guide will outline OpsLevel's support for SCIM. For more details on configuring Provisioning for specific tools, check out our specific guides:
- Okta User Provisioning with SCIM
- Microsoft Entra ID User Provisioning with SCIM
- OneLogin User Provisioning with SCIM
Features
The following provisioning features are supported by OpsLevel today:
- Push Users: Users in your identity provider that are assigned to the OpsLevel application are automatically added as users in OpsLevel
- Update User Attributes: When user attributes are updated in the identity provider, they will be updated in OpsLevel.
- Deactivate Users: When users are deactivated in the identity provider, they will be set to ‘Deactivated’ within OpsLevel – which prevents the user from logging into OpsLevel.
Requirements
SCIM-based user provisioning is available to all customers of OpsLevel at this time.
SCIM Details
OpsLevel supports the SCIM v2 User provisioning operations.
FAQs
Can SCIM manage users manually provisioned in OpsLevel?
Yes, once the SCIM tool is integrated with OpsLevel, it can also take over activating/deactivating manually provisioned users if it has a record of the user.
When SCIM provisioning is enabled, can users still log in via SSO as usual?
Yes. SCIM and JIT provisioning work together. Users who aren’t in the SCIM-provisioned groups can still log in via SSO and be provisioned through JIT.
Does a deactivated user still take up one of our licensed seats?
No. When a user is removed from the SCIM-provisioned group, SCIM deactivates them in OpsLevel, and deactivated users don’t count toward your seat total.
Will enabling SCIM deactivate or delete existing JIT users who aren’t in the SCIM groups?
No. Enabling SCIM leaves existing JIT users untouched. Because SCIM doesn’t track these users, offboarding them requires manual deactivation or deletion in OpsLevel.
Does SCIM delete users?
When we receive a delete command from SCIM, OpsLevel only deactivates users, not delete.
Updated 15 days ago