SCIM Provisioning

SCIM 2.0 (RFC 7644) lets your identity provider own Inworld membership. Assign someone to the Inworld app in Okta or Microsoft Entra ID and they become a member; move them between groups and their role changes; unassign or offboard them and their access is removed — all without anyone touching the Portal.

SCIM is available on the Enterprise plan and is configured by Owners on the Domains & SSO tab of the Team page. Admins can view the configuration.

Before you start

You need all of the following:

• A Team account on the Enterprise plan.
• At least one verified email domain. SCIM can only provision users whose email is at a domain your organization has verified.
• At least one workspace shared with the team, so provisioned members have somewhere to land. This is checked once, when you enable SCIM.
• SAML SSO configured. SCIM is not strictly dependent on it, but provisioned users need a way to sign in, and pre-provisioned accounts link themselves on their first SSO sign-in.

Set up SCIM

What SCIM manages

Supported attributes

/Users supports the core SCIM user schema:

emails is accepted where your IdP uses it to match users, but the work email is the userName in this model — there is no separate email list to maintain.

Attributes your IdP sends that Inworld does not model are ignored rather than rejected, so extra mappings in your tenant will not put the sync into an error loop.

Roles from groups

Groups exist purely to assign organization roles. Your IdP owns which groups exist and who is in them; the Portal owns what each group grants.

• A member whose groups include any group mapped to Admin gets the Admin role.
• Everyone else gets Member. Mapping a group to Member only documents that intent — Member is the floor either way.
• Owner cannot be granted through SCIM. Owners are managed in the Portal only.
• Changing a mapping, or a group's membership, recomputes the affected members' roles immediately.

Owners are never SCIM-managed

An Owner cannot be adopted, deactivated, or deleted through SCIM — those requests are rejected. Keep your Owners out of the groups you assign to the Inworld app, and manage them on the Team page.

Deprovisioning

Setting active to false, or issuing a DELETE, removes the person's access to your organization:

• their organization membership is removed;
• their memberships in that organization's workspaces are removed;
• their Inworld sign-in is disabled and existing sessions are revoked.

A deactivated user's SCIM record stays queryable — with active: false — until your IdP issues an explicit DELETE. Re-activating (active: true) restores membership with the role their groups currently grant, and re-enables sign-in.

Managed members in the Portal

While SCIM is enabled, members with an active SCIM record are marked Synced on the Team page and cannot be edited or removed there — their membership and role come from your IdP. To take manual control, turn SCIM provisioning off; the lock is released and existing records and tokens are kept for when you re-enable it.

Manage tokens

• Up to 10 active tokens per organization, so you can rotate without downtime and connect more than one IdP.
• The Portal lists each token's description, prefix, creation date, and a coarse Last used timestamp.
• Revoking a token takes effect immediately — requests using it are refused on the next call.

To rotate: generate a new token, update your IdP, confirm a successful sync, then revoke the old one.

Protocol details

Error responses

Errors use the standard SCIM error envelope.

Turn SCIM off

Turning the SCIM provisioning toggle off stops all SCIM requests and releases the managed-member lock, while keeping records, tokens, and group mappings for a later re-enable. Disabling SCIM and revoking tokens remain available even after a downgrade from Enterprise — only enabling SCIM and generating tokens require an active Enterprise plan.

Troubleshooting

Next steps