SCIM

SCIM (System for Cross-domain Identity Management) 2.0 lets your identity provider automatically create, update, and deactivate Vince Platform accounts as your directory changes. This removes the need to manually maintain users in two places.

---

Supported identity providers

• Microsoft Entra ID (formerly Azure AD)
• Okta
• OneLogin

---

What is provisioned

SCIM provisions and deprovisions user accounts. The following operations are supported:

Operation	What happens in Vince Platform
Create user	A new user account is created
Update user	The user's name or email is updated
Deactivate user	The account is deactivated — the user can no longer sign in
Reactivate user	The account is reactivated if the user is reassigned in the IdP

Groups and roles are managed separately in Vince Platform and are not provisioned via SCIM.

---

User attributes

The following attributes are synchronised from your identity provider:

SCIM attribute	Vince Platform field
userName	Email (used as the login identifier)
name.givenName	First name
name.familyName	Last name
emails[primary]	Email
active	Active status

---

Setting up SCIM

The SCIM tab (Administration → Company Management → SCIM) provides the values you need to configure your identity provider.

1. Copy the SCIM endpoint and token

From the SCIM tab, copy:

• SCIM Endpoint URL — the base URL your IdP will send provisioning requests to
• Bearer Token — the authentication token for the SCIM API

Store the bearer token securely. It is not shown again after initial generation — if it is lost, regenerate it from the SCIM tab.

2. Configure your identity provider

Microsoft Entra ID

1. In the Azure portal, open Enterprise applications and select your Vince Platform app.
2. Go to Provisioning and set the Provisioning Mode to Automatic.
3. Under Admin Credentials, paste the SCIM Endpoint URL into Tenant URL and the bearer token into Secret Token.
4. Click Test Connection to confirm the credentials work.
5. Set the Provisioning Scope and click Save.
6. Enable provisioning and click Start provisioning.

Okta

1. In the Okta admin console, open your Vince Platform app and go to the Provisioning tab.
2. Click Configure API Integration and enable Enable API integration.
3. Paste the bearer token into API Token and the SCIM Endpoint URL into Base URL.
4. Click Test API Credentials to validate the connection.
5. Under To App, enable Create Users, Update User Attributes, and Deactivate Users.
6. Save the configuration.

OneLogin

1. In the OneLogin admin portal, open the Vince Platform app and go to the Configuration tab.
2. Enter the SCIM Endpoint URL into SCIM Base URL and the bearer token into SCIM Bearer Token.
3. Click Enable to activate provisioning.
4. In the Provisioning tab, enable Enable Provisioning.

---

Regenerating the bearer token

If the bearer token is compromised or lost, click Regenerate Token on the SCIM tab. The old token is immediately invalidated — update your identity provider with the new token to restore provisioning.

---

Troubleshooting

Symptom	Likely cause	Resolution
Test connection fails	Incorrect endpoint URL or expired token	Double-check the endpoint URL and regenerate the token if needed
Users are not being created	Provisioning not enabled in the IdP	Enable provisioning and verify the scope includes the users you expect
Users are not being deactivated	"Deactivate Users" not enabled in the IdP	Enable the deactivation setting in your IdP provisioning configuration
Attribute mismatch	IdP attribute mappings are incorrect	Review the attribute table above and adjust the IdP mapping to match

---

Further reading

• Users — manually manage accounts for users outside the IdP
• Single Sign-On — pair SCIM provisioning with SSO for a fully automated identity lifecycle