> ## Documentation Index
> Fetch the complete documentation index at: https://absentify.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM 2.0 provisioning

> Set up SCIM 2.0 user and group provisioning in absentify to automate synchronization with Microsoft Entra ID, Okta, and other identity providers.

Unlock streamlined identity management with **SCIM 2.0 Provisioning**. Automate user and group synchronization between your identity provider (IdP) and absentify using the industry-standard SCIM protocol.

<Info>
  SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning. It works with any SCIM-compatible identity provider, including Microsoft Entra ID, Okta, OneLogin, Ping Identity, and more.
</Info>

***

## Benefits of SCIM provisioning

* **Identity provider-independent**: Works with any SCIM 2.0 compatible IdP, not just Microsoft
* **Granular control**: Define exactly which users and groups are provisioned to absentify — ideal for organizations that need precise control over what data is synchronized
* **Automated user lifecycle**: Automatically create, update, and deactivate user accounts
* **Group-based provisioning**: Synchronize group memberships to absentify departments
* **Push-based updates**: Your IdP pushes changes to absentify in real-time
* **Standardized protocol**: Uses RFC 7643/7644 compliant SCIM 2.0

<Tip>
  **Microsoft Entra ID users**: If you need additional features like group owner synchronization or profile pictures, consider using the native [Microsoft Graph synchronization](/docs/en/roles/hr_admins/settings/integrations/teams_group_entra_id_group_sync) instead. SCIM is ideal when you need granular control over which users are provisioned or when using non-Microsoft identity providers.
</Tip>

<Warning>
  SCIM provisioning requires a **Plus subscription**. [Upgrade your plan](/docs/en/roles/hr_admins/settings/upgrade) to enable this feature.
</Warning>

***

## Prerequisites

Before you begin, ensure the following:

* An **absentify** account with admin rights
* A **Plus subscription** or higher
* Access to your identity provider's admin console with permissions to configure SCIM provisioning

***

## Getting started

### Step 1: Generate a SCIM token

1. Navigate to **Settings > Integrations > SCIM Provisioning** in absentify
2. Select **Generate Token**
3. **Important**: Copy the token immediately — it will only be displayed once
4. Note the **Tenant URL**: `https://api.absentify.com/api/scim/v2`

<Warning>
  Store your token securely. If you lose it, you'll need to generate a new one, which will invalidate the previous token.
</Warning>

***

### Step 2: Configure your identity provider

The configuration steps vary depending on your identity provider. Below are instructions for common IdPs.

<Tabs>
  <Tab title="Microsoft Entra ID">
    #### Create an enterprise application

    1. Open the [Microsoft Entra Admin Center](https://entra.microsoft.com)
    2. Navigate to **Enterprise applications > New application**
    3. Select **Create your own application**
    4. Name it "absentify SCIM Provisioning"
    5. Select **Integrate any other application you don't find in the gallery**
    6. Select **Create**

    #### Configure provisioning

    1. In the new application, go to **Provisioning > Get started**
    2. Set **Provisioning Mode** to **Automatic**
    3. Under **Admin Credentials**:
       * **Tenant URL**: `https://api.absentify.com/api/scim/v2`
       * **Secret Token**: Paste the token from Step 1
    4. Select **Test Connection** to verify the connection
    5. Select **Save**

    #### Configure attribute mappings

    **Recommended User Mappings:**

    | Entra ID Attribute                                           | SCIM Attribute                                                            |
    | ------------------------------------------------------------ | ------------------------------------------------------------------------- |
    | userPrincipalName                                            | userName                                                                  |
    | displayName                                                  | displayName                                                               |
    | givenName                                                    | name.givenName                                                            |
    | surname                                                      | name.familyName                                                           |
    | mail                                                         | emails\[type eq "work"].value                                             |
    | Switch(\[IsSoftDeleted], , "False", "True", "True", "False") | active                                                                    |
    | objectId                                                     | externalId                                                                |
    | preferredLanguage                                            | preferredLanguage                                                         |
    | employeeId                                                   | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber |
    | manager                                                      | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager        |

    **Recommended Group Mappings:**

    | Entra ID Attribute | SCIM Attribute |
    | ------------------ | -------------- |
    | displayName        | displayName    |
    | objectId           | externalId     |
    | members            | members        |

    #### Assign users and groups

    1. Under **Settings > Scope**, select:
       * **Sync only assigned users and groups** (recommended)
       * or **Sync all users and groups**
    2. Assign the users and groups you want to provision

    #### Start provisioning

    1. Select **Start provisioning**
    2. The initial sync may take 20-40 minutes depending on the number of users
    3. Monitor progress in **Provisioning logs**
  </Tab>

  <Tab title="Okta">
    1. In Okta Admin Console, go to **Applications > Applications**
    2. Select **Create App Integration**
    3. Select **SCIM 2.0 Test App (Header Auth)**
    4. Configure the SCIM connection:
       * **SCIM connector base URL**: `https://api.absentify.com/api/scim/v2`
       * **Unique identifier field**: `userName`
       * **Authentication Mode**: HTTP Header
       * **Authorization**: Bearer \[Your Token]
    5. Enable the provisioning features you need
    6. Assign users and groups to the application
  </Tab>

  <Tab title="Other IdPs">
    For other identity providers, use these settings:

    * **SCIM Base URL**: `https://api.absentify.com/api/scim/v2`
    * **Authentication**: OAuth Bearer Token
    * **Token**: The token generated in Step 1
    * **SCIM Version**: 2.0

    Consult your IdP's documentation for specific configuration steps.
  </Tab>
</Tabs>

***

## Configure group synchronization

After your IdP starts provisioning groups to absentify, you can map them to departments.

### Step 1: Access group synchronization settings

1. Navigate to **Settings > Integrations > SCIM Provisioning**
2. Select **Group Synchronization**
3. Select **Add a group synchronization**

***

### Step 2: Configure the synchronization

1. **Name your synchronization**: Use a descriptive name that matches the group and department
2. **Select the SCIM group**: Select from the groups provisioned by your IdP
3. **Select absentify departments**: Map the group to one or more departments
4. **Configure sync options**: Enable the features you need (see below)

***

## Synchronization options

### Enable auto-creation of user accounts

Automatically create absentify accounts for users in SCIM groups who are not yet in the system.

1. Toggle **Enable Auto-Creation of user accounts**
2. New users will be created as **inactive** accounts
3. Group owners receive an email notification to activate new accounts
4. New accounts receive a pro-rata allowance based on their start date

#### Key points

* **Users already in the workspace**: When existing users are added to a synced group, they will also be assigned to the corresponding synced department
* **Users not yet in the workspace**: New users are created as inactive and assigned to the synced department
* **Manual department assignment not possible**: You cannot manually assign a user to a department that is part of a SCIM sync

***

### Manage department membership and archive users

Keep absentify departments aligned with SCIM group changes.

1. Toggle **Manage department membership on group updates and archive users not assigned to departments**
2. When users are removed from a SCIM group:
   * If they belong to other departments, they remain active
   * If they have no other department assignments, they are automatically archived

<Info>
  Archiving occurs approximately 10 minutes after group updates. A slight delay may occur if the same user is removed from multiple groups in quick succession.
</Info>

***

## Supported SCIM features

### User attributes

| Attribute         | Type    | Required | Description                                                                                         |
| ----------------- | ------- | -------- | --------------------------------------------------------------------------------------------------- |
| userName          | String  | ✅        | Unique identifier (e.g., UPN)                                                                       |
| name.givenName    | String  | ❌        | First name                                                                                          |
| name.familyName   | String  | ❌        | Last name                                                                                           |
| displayName       | String  | ❌        | Display name                                                                                        |
| emails\[].value   | String  | ❌        | Email address                                                                                       |
| emails\[].primary | Boolean | ❌        | Primary email flag                                                                                  |
| active            | Boolean | ❌        | Active/inactive status                                                                              |
| externalId        | String  | ❌        | External ID from IdP                                                                                |
| preferredLanguage | String  | ❌        | Preferred language (e.g., "de", "en")                                                               |
| employeeNumber    | String  | ❌        | Employee number (enterprise extension)                                                              |
| manager           | Complex | ❌        | Direct manager reference (enterprise extension) — used for **Sync approver with Microsoft Manager** |

<Info>
  Map the enterprise `manager` attribute to provision each user's profile manager. absentify uses these relationships for approver sync. This is separate from group-owner sync for department managers, which remains Microsoft Graph only. See [Configuring approvers](/docs/en/roles/hr_admins/settings/users/edit/approver#2-microsoft-profile-synchronization).
</Info>

### Group attributes

| Attribute        | Type   | Required | Description          |
| ---------------- | ------ | -------- | -------------------- |
| displayName      | String | ✅        | Group name           |
| externalId       | String | ❌        | External ID from IdP |
| members\[].value | String | ❌        | User IDs of members  |

<Info>
  **Language fallback**: If `preferredLanguage` is not set, the workspace's default language is used.
</Info>

***

## SCIM vs. Microsoft Graph sync

If you're using Microsoft Entra ID, you can choose between SCIM and native Microsoft Graph synchronization.

| Feature                                      | SCIM | Microsoft Graph |
| -------------------------------------------- | ---- | --------------- |
| User synchronization                         | ✅    | ✅               |
| Group synchronization                        | ✅    | ✅               |
| Auto-creation of accounts                    | ✅    | ✅               |
| Department assignment                        | ✅    | ✅               |
| User deactivation                            | ✅    | ✅               |
| **Group owner sync for department managers** | ❌    | ✅               |
| **Profile manager sync for approvers**       | ✅    | ✅               |
| **Profile picture sync**                     | ❌    | ✅               |
| IdP-independent                              | ✅    | ❌               |
| Push-based updates                           | ✅    | ❌               |

**Use SCIM when:**

* You use a non-Microsoft identity provider (Okta, OneLogin, etc.)
* You want a standardized, IdP-independent solution
* You need granular control over exactly which users and groups are provisioned
* You want manager-based approvers without granting Microsoft Graph **User.Read.All**

**Use Microsoft Graph when:**

* Microsoft 365 / Entra ID is your primary IdP
* You want to sync group owners as department managers
* You want to sync profile pictures
* You want automatic provisioning of all users in a group without additional IdP configuration

<Warning>
  SCIM and Microsoft Graph cannot be configured for the same group simultaneously. Different groups can use different sync methods.
</Warning>

***

## Token management

### Token validity

* Default validity: 12 months
* Expiration date is displayed in the settings

### Regenerate token

1. Navigate to SCIM settings
2. Select **Regenerate Token**
3. The old token is immediately invalidated
4. Update the token in your IdP configuration

### Revoke token

* Select the trash icon next to the masked token
* All SCIM requests will be rejected immediately
* Provisioned users and groups remain in absentify

***

## Troubleshooting

### Common issues

| Issue                 | Possible cause             | Solution                            |
| --------------------- | -------------------------- | ----------------------------------- |
| Connection test fails | Invalid token              | Generate a new token and update IdP |
| Users not created     | Plus subscription required | Upgrade to Plus plan                |
| Groups not appearing  | Groups not provisioned yet | Check IdP provisioning logs         |
| User not archived     | Multiple group removals    | Wait 10-15 minutes and check again  |

### Check sync logs

1. Navigate to **Settings > Microsoft > Sync Logs**
2. Filter by **Operation** and select **SCIM Provisioning**
3. Review the logs for errors or skipped events

***

## Limitations

* **No group owner sync**: SCIM 2.0 does not support group owners or administrators, so department managers cannot be synced from group owners. Profile managers for approvers are supported via the enterprise `manager` attribute.
* **No profile pictures**: SCIM does not support image synchronization.

***

## FAQ

<AccordionGroup>
  <Accordion title="Can I use SCIM and Microsoft Graph simultaneously?">
    Yes, but not for the same group. Different groups can use different synchronization methods.
  </Accordion>

  <Accordion title="Why can't I sync group managers with SCIM?">
    SCIM 2.0 does not include a concept of group owners or administrators. This is a protocol limitation, not an absentify limitation.
  </Accordion>

  <Accordion title="Can SCIM synchronize managers for approvers?">
    Yes. Map the enterprise `manager` attribute to provision each user's direct profile manager. absentify uses these relationships for the **Sync approver with Microsoft Manager** option; group-owner synchronization for department managers remains available only through Microsoft Graph.
  </Accordion>

  <Accordion title="What happens when a user is deactivated?">
    The user is marked as inactive in absentify. Depending on your sync configuration, they may also be archived if they have no other department assignments.
  </Accordion>

  <Accordion title="How long does the initial sync take?">
    The initial sync typically takes 20-40 minutes depending on the number of users and groups. Incremental updates are much faster.
  </Accordion>

  <Accordion title="Are existing users overwritten?">
    No. SCIM users are stored separately and linked to absentify members by email. Existing profile data is not overwritten.
  </Accordion>
</AccordionGroup>