What is SCIM provisioning and when should I use it?
SCIM lets your identity provider create, update, and disable Users and Groups in SpeakUp automatically. Rather than creating an account each time you hire someone and revoking it when they leave, your identity provider becomes the single source of truth and SpeakUp follows.
SCIM provisioning is one-way, from your identity provider to SpeakUp. Changes made directly in SpeakUp to provisioned Users or Groups can be overwritten by the next sync.
On this page: What SCIM solves · Which authentication method you need · Access levels · What SCIM manages · What SCIM does not do · How Users are removed · Sync direction and timing · Common questions
What SCIM solves
Without SCIM, managing Users across multiple systems is manual and error-prone:
- New employees need accounts created in SpeakUp, and in every other system they use.
- When employees change roles or departments, their permissions must be updated everywhere.
- When employees leave, you must revoke access across all systems, and it is easy to miss one.
With SCIM these changes happen automatically. User attributes stay in sync, group memberships follow, and offboarding in your identity provider deactivates the SpeakUp account without anyone remembering to do it.
Which authentication method you need
SCIM connects through an App Integration in SpeakUp, and the authentication method depends on how your identity provider connects to SCIM services. Choose before you create the integration, because the method is set at creation.
| Your identity provider | Authentication method | Set it up with |
|---|---|---|
| Connects using OAuth 2.0 client credentials, for example Microsoft Entra ID | Client credentials | How do I set up SCIM using the client credentials flow? |
| Connects using the OAuth 2.0 authorisation code flow, for example Okta | Authorisation Code Flow | How do I set up SCIM using the authorisation code flow? |
If you are not sure which your identity provider uses, check how it authenticates to SCIM targets. The authorisation code flow requires a redirect URL and an administrator to authorise the connection interactively. Client credentials does not.
Access levels
When you create the App Integration you set an access level for Users and Groups. This determines which operations your identity provider can perform.
| Level | What it allows | Use it for |
|---|---|---|
| Read only | Retrieving and listing Users and Groups. It cannot create, update, or disable anything, and cannot modify group membership. | Audit and reporting integrations that query User data but never change it. |
| Full access | Everything read only allows, plus creating, updating, deactivating, and removing Users, and creating, updating, and deleting Groups and their membership. | Production provisioning, where your identity provider is the source of truth. |
Full access is required for provisioning. With read only access, an identity provider can retrieve Users and Groups but cannot create or disable them.
What SCIM manages
SpeakUp's SCIM API manages two resources.
Users
Individual accounts that can be created, updated, disabled, or removed. Attributes fall into three groups:
- Core attributes: username, email, first name, last name, active status
- User profile attributes: title, phone, preferred language
- Enterprise attributes: department, division, manager, cost centre, user type
Newly created Users automatically receive a SpeakUp invitation email.
Groups
Collections of Users that share access requirements or organisational structure, such as teams, departments, or roles. Groups let you assign permissions to many Users at once.
For the endpoints and payloads, see SCIM Users API and SCIM Groups API.
What SCIM does not do
| Not supported | What it means |
|---|---|
| Custom user attributes | Only the attributes listed above sync. Attributes specific to your organisation cannot be synced. |
| Bidirectional sync | Your identity provider is the source of truth. Changes in SpeakUp are not synced back. |
| Nested groups | Groups within groups are not supported. |
| Distribution lists and mail-enabled groups | Only security groups are supported. |
| User deletion | SCIM deactivates Users by setting active: false rather than deleting them, preventing accidental data loss. |
Never change a User's email address or username from your identity provider's app assignment. These must be changed in the identity provider's own user directory. Changing them through the SCIM connection disables the User in SpeakUp.
How Users are removed
When an employee leaves, SCIM deactivates rather than deletes.
- In your identity provider, the User is marked inactive or disabled.
- SpeakUp receives the update and sets the User's
activestatus tofalse. - The account is deactivated but not deleted. The data remains in SpeakUp for audit and historical purposes.
- The User can no longer sign in or access SpeakUp.
This preserves historical records and maintains data integrity across the system.
Sync direction and timing
Your identity provider is the master source. User and Group changes there flow into SpeakUp automatically. Changes made in SpeakUp do not flow back.
An initial sync runs when you first enable provisioning, and may take longer for large organisations. After that, only changed Users and Groups are updated.
Sync frequency is set by your identity provider, not by SpeakUp. Microsoft Entra ID, for example, syncs every 40 minutes. Check your provider's documentation for its schedule.
Common questions
What happens if a User exists in both SpeakUp and my identity provider?
SpeakUp matches Users by email address. If a User with the same email exists, the SCIM integration updates that User's information from your identity provider.
Can I use SCIM for Users without Groups?
Yes. You can enable User provisioning without group sync if your use case does not require it.
What about Users in SpeakUp who are not in my identity provider?
They remain unaffected. SCIM only manages Users it has synced. Users created directly in SpeakUp are not touched.
How do I stop SCIM provisioning?
Disable the provisioning setting in your identity provider. This stops new syncs but does not delete existing Users in SpeakUp.
Which attributes are required?
At minimum a unique identifier, either userName or email, and an email address. Other attributes are optional.
Standards
SpeakUp implements SCIM 2.0, defined by IETF RFC 7642, RFC 7643, and RFC 7644.