SCIM provisioning — users and groups from your directory

SCIM provisioning — users and groups from your directoryThe SCIM 2.0 endpoint your identity provider pushes users and groups to, the authoritative directory that decides roles on every request, and how to connect Entra ID and Okta. ATX AnalyticsTable accepts SCIM 2.0 provisioning, the standard Entra ID, Okta, OneLogin, Ping and others use to push users and groups into an application. When the directory is authoritative — the default as soon as a SCIM token exists — it, not the sign-in token, decides who exists and which roles and groups they hold, on every request. A person removed from a group loses what that group gave them on their next click, not when their token expires.

Overview

ATX AnalyticsTable accepts SCIM 2.0 provisioning, the standard Entra ID, Okta, OneLogin, Ping and others use to push users and groups into an application. When the directory is authoritative — the default as soon as a SCIM token exists — it, not the sign-in token, decides who exists and which roles and groups they hold, on every request. A person removed from a group loses what that group gave them on their next click, not when their token expires.
Open Settings → Identity (Entra ID) → SCIM provisioning: Settings → Settings → Set / Restore → Identity (Entra ID)

Connect your identity provider

1. Open Settings → Identity (Entra ID) → SCIM provisioning and click Generate token. Copy the token at once — it is shown only this once, and only its SHA-256 digest is kept.
2. In the identity provider, create the provisioning connection: Tenant URL (or SCIM base URL) https://<your server>/scim/v2, as shown under Tenant URL, and the token as the secret / bearer token.
3. Test the connection in the provider, assign the people and groups who should use ATX AnalyticsTable, and start provisioning.
4. Back in Settings → Identity (Entra ID), the status line counts the users, active users and groups the directory holds.
The SCIM token is not the server's shared API token, and it opens nothing under /api: a leaked SCIM token lets someone edit the directory, never read data or credentials. Remove token stops provisioning at once. In a container, the digest can be given instead as ANALYTICS_SCIM_TOKEN_SHA256 (several, comma-separated).

Microsoft Entra ID

1. Enterprise applications → the ATX AnalyticsTable app → Provisioning → Automatic. Enter the Tenant URL and Secret Token, then Test Connection.
2. Under Mappings, keep the default user and group mappings. To send app roles too, add a mapping to roles with the expression AppRoleAssignmentsComplex([appRoleAssignments]).
3. To match people by object id as well as by sign-in name, map objectId to externalId.
4. Save, set Provisioning Status to On. Entra provisions on a cycle of about 40 minutes; use Provision on demand for a change that cannot wait.

Okta

1. Applications → the app → General → enable SCIM provisioning, then Provisioning → Integration: SCIM connector base URL https://<your server>/scim/v2, unique identifier field userName, authentication mode HTTP Header with the token.
2. Turn on Create Users, Update User Attributes and Deactivate Users, and push the groups that carry roles under Push Groups.

What the authoritative directory does on every request

Not in the directory — Refused with 403 not_provisioned — the provider has not pushed them yet.
In the directory but inactive — Refused with 403 account_disabled.
Matched by more than one directory entry — Refused with 403 directory_ambiguous, rather than guessing whose roles they get.
Found and active — Their roles and groups are REPLACED by the directory's: the roles provisioned on the user, and the display name, external id and id of every group they belong to.
A person is matched by external id equal to their sign-in subject, then by user name, then by e-mail. Because Entra provisions a group with its object id as the external id, a role map written with Entra group object ids keeps working unchanged. Deactivating or deleting a user also ends their sessions and revokes every credential issued before that moment, and that revocation stands even if the directory is switched off later. ANALYTICS_SCIM_MODE=off keeps receiving updates but stops consulting the directory.

What the endpoint supports

Resources — /Users and /Groups — list with filter, startIndex, count, attributes and excludedAttributes; read, create, replace, PATCH and delete
Discovery — /ServiceProviderConfig, /ResourceTypes, /Schemas
Filters — eq, ne, co, sw, ew, gt, lt, ge, le, pr; and, or, not, parentheses and value paths such as emails[type eq "work"]
PATCH dialects — Entra (capitalised operations, "False" as a string, member removal by value list) and Okta (operations without a path, members[value eq "…"])
Schemas — Core User and Group, and the enterprise user extension
Not supported — Bulk, sorting, ETags and nested groups (identity providers flatten nested groups when they provision)
Every change is written to the audit trail — scim.user.create, replace, patch, deactivated and deleted, scim.group.*, and scim.auth_failed for a wrong token. PATCH records note the operation and the attribute path, never the values.
The directory is a file on the server that receives the provisioning. A deployment with several replicas must route /scim/v2 to one of them.

ATX Institute — home

Products

Company

Resources

Guides

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.