SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning. It works with any SCIM-compatible identity provider, including Microsoft Entra ID, Okta, OneLogin, Ping Identity, and more.
Benefits of SCIM provisioning
- Identity provider-independent: Works with any SCIM 2.0 compatible IdP, not just Microsoft
- Granular control: Define exactly which users and groups are provisioned to absentify — ideal for organizations that need precise control over what data is synchronized
- Automated user lifecycle: Automatically create, update, and deactivate user accounts
- Group-based provisioning: Synchronize group memberships to absentify departments
- Push-based updates: Your IdP pushes changes to absentify in real-time
- Standardized protocol: Uses RFC 7643/7644 compliant SCIM 2.0
Prerequisites
Before you begin, ensure the following:- An absentify account with admin rights
- A Plus subscription or higher
- Access to your identity provider’s admin console with permissions to configure SCIM provisioning
Getting started
Step 1: Generate a SCIM token
- Navigate to Settings > Integrations > SCIM Provisioning in absentify
- Click Generate Token
- Important: Copy the token immediately — it will only be displayed once
- Note the Tenant URL:
https://api.absentify.com/api/scim/v2
Step 2: Configure your identity provider
The configuration steps vary depending on your identity provider. Below are instructions for common IdPs.- Microsoft Entra ID
- Okta
- Other IdPs
Create an Enterprise Application
- Open the Microsoft Entra Admin Center
- Navigate to Enterprise applications > New application
- Click Create your own application
- Name it “absentify SCIM Provisioning”
- Select Integrate any other application you don’t find in the gallery
- Click Create
Configure Provisioning
- In the new application, go to Provisioning > Get started
- Set Provisioning Mode to Automatic
- Under Admin Credentials:
- Tenant URL:
https://api.absentify.com/api/scim/v2 - Secret Token: Paste the token from Step 1
- Tenant URL:
- Click Test Connection to verify the connection
- Click Save
Configure Attribute Mappings
Recommended User Mappings:| Entra ID Attribute | SCIM Attribute |
|---|---|
| userPrincipalName | userName |
| displayName | displayName |
| givenName | name.givenName |
| surname | name.familyName |
| emails[type eq “work”].value | |
| Switch([IsSoftDeleted], , “False”, “True”, “True”, “False”) | active |
| objectId | externalId |
| preferredLanguage | preferredLanguage |
| employeeId | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber |
| Entra ID Attribute | SCIM Attribute |
|---|---|
| displayName | displayName |
| objectId | externalId |
| members | members |
Assign Users and Groups
- Under Settings > Scope, choose:
- Sync only assigned users and groups (recommended)
- or Sync all users and groups
- Assign the users and groups you want to provision
Start Provisioning
- Click Start provisioning
- The initial sync may take 20-40 minutes depending on the number of users
- Monitor progress in Provisioning logs
Configure group synchronization
After your IdP starts provisioning groups to absentify, you can map them to departments.Step 1: Access group synchronization settings
- Navigate to Settings > Integrations > SCIM Provisioning
- Click Group Synchronization
- Click Add a group synchronization
Step 2: Configure the synchronization
- Name your synchronization: Use a descriptive name that matches the group and department
- Select the SCIM group: Choose from the groups provisioned by your IdP
- Select absentify departments: Map the group to one or more departments
- Configure sync options: Enable the features you need (see below)
Synchronization options
Enable auto-creation of user accounts
Automatically create absentify accounts for users in SCIM groups who are not yet in the system.- Toggle Enable Auto-Creation of user accounts
- New users will be created as inactive accounts
- Group owners receive an email notification to activate new accounts
- New accounts receive a pro-rata allowance based on their start date
Key points
- Users already in the workspace: When existing users are added to a synced group, they will also be assigned to the corresponding synced department
- Users not yet in the workspace: New users are created as inactive and assigned to the synced department
- Manual department assignment not possible: You cannot manually assign a user to a department that is part of a SCIM sync
Manage department membership and archive users
Keep absentify departments aligned with SCIM group changes.- Toggle Manage department membership on group updates and archive users not assigned to departments
- When users are removed from a SCIM group:
- If they belong to other departments, they remain active
- If they have no other department assignments, they are automatically archived
Archiving occurs approximately 10 minutes after group updates. A slight delay may occur if the same user is removed from multiple groups in quick succession.
Supported SCIM features
User attributes
| Attribute | Type | Required | Description |
|---|---|---|---|
| userName | String | ✅ | Unique identifier (e.g., UPN) |
| name.givenName | String | ❌ | First name |
| name.familyName | String | ❌ | Last name |
| displayName | String | ❌ | Display name |
| emails[].value | String | ❌ | Email address |
| emails[].primary | Boolean | ❌ | Primary email flag |
| active | Boolean | ❌ | Active/inactive status |
| externalId | String | ❌ | External ID from IdP |
| preferredLanguage | String | ❌ | Preferred language (e.g., “de”, “en”) |
| employeeNumber | String | ❌ | Employee number (enterprise extension) |
Group attributes
| Attribute | Type | Required | Description |
|---|---|---|---|
| displayName | String | ✅ | Group name |
| externalId | String | ❌ | External ID from IdP |
| members[].value | String | ❌ | User IDs of members |
Language fallback: If
preferredLanguage is not set, the workspace’s default language is used.SCIM vs. Microsoft Graph sync
If you’re using Microsoft Entra ID, you can choose between SCIM and native Microsoft Graph synchronization.| Feature | SCIM | Microsoft Graph |
|---|---|---|
| User synchronization | ✅ | ✅ |
| Group synchronization | ✅ | ✅ |
| Auto-creation of accounts | ✅ | ✅ |
| Department assignment | ✅ | ✅ |
| User deactivation | ✅ | ✅ |
| Group owner/manager sync | ❌ | ✅ |
| Profile picture sync | ❌ | ✅ |
| IdP-independent | ✅ | ❌ |
| Push-based updates | ✅ | ❌ |
- You use a non-Microsoft identity provider (Okta, OneLogin, etc.)
- You want a standardized, IdP-independent solution
- You need granular control over exactly which users and groups are provisioned
- You only need user and group synchronization
- Microsoft 365 / Entra ID is your primary IdP
- You want to sync group owners as department managers
- You want to sync profile pictures
- You want automatic provisioning of all users in a group without additional IdP configuration
Token management
Token validity
- Default validity: 12 months
- Expiration date is displayed in the settings
Regenerate token
- Navigate to SCIM settings
- Click Regenerate Token
- The old token is immediately invalidated
- Update the token in your IdP configuration
Revoke token
- Click the trash icon next to the masked token
- All SCIM requests will be rejected immediately
- Provisioned users and groups remain in absentify
Troubleshooting
Common issues
| Issue | Possible cause | Solution |
|---|---|---|
| Connection test fails | Invalid token | Generate a new token and update IdP |
| Users not created | Plus subscription required | Upgrade to Plus plan |
| Groups not appearing | Groups not provisioned yet | Check IdP provisioning logs |
| User not archived | Multiple group removals | Wait 10-15 minutes and check again |
Check sync logs
- Navigate to Settings > Microsoft > Sync Logs
- Filter by Operation and select SCIM Provisioning
- Review the logs for errors or skipped events
Limitations
- No group owner sync: SCIM 2.0 does not support group owners/administrators. Manager synchronization is not available with SCIM.
- No profile pictures: SCIM does not support image synchronization.
FAQ
Can I use SCIM and Microsoft Graph simultaneously?
Can I use SCIM and Microsoft Graph simultaneously?
Yes, but not for the same group. Different groups can use different synchronization methods.
Why can't I sync group managers with SCIM?
Why can't I sync group managers with SCIM?
SCIM 2.0 does not include a concept of group owners or administrators. This is a protocol limitation, not an absentify limitation.
What happens when a user is deactivated?
What happens when a user is deactivated?
The user is marked as inactive in absentify. Depending on your sync configuration, they may also be archived if they have no other department assignments.
How long does the initial sync take?
How long does the initial sync take?
The initial sync typically takes 20-40 minutes depending on the number of users and groups. Incremental updates are much faster.
Are existing users overwritten?
Are existing users overwritten?
No. SCIM users are stored separately and linked to absentify members by email. Existing profile data is not overwritten.