SCIM
By IETF
SCIM, System for Cross-domain Identity Management, is an open standard that automates the creation, update, and deactivation of user accounts across multiple applications and services. It defines a common REST and JSON schema for identity…
Definition
SCIM, System for Cross-domain Identity Management, is an open standard that automates the creation, update, and deactivation of user accounts across multiple applications and services. It defines a common REST and JSON schema for identity data, allowing an identity provider to provision and deprovision user accounts in downstream applications automatically instead of relying on slow, error-prone manual account management processes.
Overview
SCIM addresses the operational burden of keeping user accounts consistent across dozens of applications an organization uses. Without an automated standard, adding a new employee means manually creating accounts in every tool they need, and removing someone means manually deactivating each one, a process that is slow and prone to leaving orphaned accounts active after someone leaves, which is a common source of security exposure. SCIM standardizes this so an identity provider can push account changes to every connected application automatically and consistently. Mechanically, SCIM defines a REST API with a standardized JSON schema for representing users and groups, including common attributes like name, email, and group membership, plus an extension mechanism for custom attributes. An identity provider acting as the SCIM client sends HTTP requests, create, update, and delete operations, to a target application's SCIM endpoint whenever an event occurs, such as a new hire being added to an HR system, a role change, or an employee's departure. The receiving application implements the SCIM server side, translating those standardized requests into whatever internal user model it maintains, which means any application supporting SCIM can plug into any SCIM-capable identity provider without custom integration work for each pairing. SCIM is commonly confused with SAML or OAuth 2.0, but it solves a different problem: those protocols handle a user proving their identity or an application requesting authorized access at login time, while SCIM handles the lifecycle of the account itself, existing before any login ever happens and continuing after, including deactivation. In most enterprise deployments, SCIM and a protocol like SAML or OpenID Connect work together, with SCIM provisioning the account and SAML or OIDC handling the actual sign-in. In practice, identity providers such as Okta, Azure Active Directory, and Ping Identity use SCIM to automatically provision accounts in downstream SaaS applications the moment an employee is added to a group, and to deactivate those same accounts within minutes of an offboarding event triggered in an HR system. This tight loop between HR systems, identity providers, and SaaS applications is what SCIM is primarily built to enable. Its adoption depends on both sides implementing the standard correctly; many applications support SCIM only partially, covering user creation but not full attribute syncing or group provisioning, which forces organizations to fall back on manual processes for the gaps. SCIM also does not handle authentication itself, so it must be paired with a separate protocol to actually let the provisioned user log in.
Specification
- Standardized REST and JSON schema for user and group provisioning
- Automates account creation, updates, and deactivation across applications
- Reduces orphaned accounts left active after employee offboarding
- Works alongside SAML or OIDC, which handle authentication separately
- Extension mechanism supports custom organization-specific attributes
- Widely implemented by major identity providers for SaaS integrations
- Enables near-real-time deprovisioning triggered by HR system events