Skip to main content

SCIM Provisioning

Automated user provisioning via SCIM 2.0.

Overview​

SCIM (System for Cross-domain Identity Management) enables automatic:

  • User Creation: Users created automatically
  • Role Assignment: Roles assigned via IdP groups
  • User Updates: User changes synced automatically
  • User Deprovisioning: Users removed when access is revoked

Configuration​

Step 1: Enable SCIM in Toggly​

  1. Navigate to Settings → SCIM in Toggly
  2. Enable SCIM provisioning
  3. Generate SCIM token
  4. Note the SCIM endpoint URL

Step 2: Configure Identity Provider​

  1. In your IdP, configure SCIM provisioning
  2. Enter Toggly's SCIM endpoint:
    • URL: https://app.toggly.io/scim/v2
    • Token: Your SCIM token from Toggly
  3. Configure group mapping
  4. Test provisioning

Group Mapping​

Map IdP groups to Toggly roles:

  • Admin Group → Admin role
  • Developer Group → Developer role
  • Viewer Group → Viewer role

User Lifecycle​

Creation​

When a user is added to a mapped group in your IdP:

  1. IdP sends SCIM request to Toggly
  2. Toggly creates user account
  3. User is assigned role based on group
  4. User receives welcome email

Updates​

When user attributes change in your IdP:

  1. IdP sends SCIM update request
  2. Toggly updates user attributes
  3. Role changes if group membership changes

Deprovisioning​

When user is removed from all mapped groups:

  1. IdP sends SCIM delete request
  2. Toggly deactivates user account
  3. User loses access to Toggly

Best Practices​

  1. Test First: Test in development environment
  2. Group Mapping: Map groups carefully to roles
  3. Monitor Logs: Watch SCIM logs for issues
  4. Backup Access: Maintain admin access outside SCIM

Next Steps​