Provision enterprise accounts with System for Cross-domain Identity Management (SCIM).
System for Cross-domain Identity Management (SCIM) standardizes user and group lifecycle management over Hypertext Transfer Protocol (HTTP). Single sign-on handles authentication; provisioning decides whether an account and its assignments should exist.
Why this lesson?
An enterprise gives an employee access to a software-as-a-service (SaaS) application, synchronizes a group assignment, and must promptly disable the account when the employee leaves.
Learning goal and prerequisites
Provision a user
An enterprise provisioning system creates or updates the software-as-a-service account through the SCIM Users resource. The request carries identity attributes defined by the SCIM schema. Authentication for this application programming interface (API) is deployment-specific; this simulation uses an illustrative bearer credential.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Single sign-on answers how a person authenticates, but an enterprise also needs to manage whether that person should have an account in each application at all. Employees join, change teams, and leave. Manually creating and deleting accounts in every software service is slow and can leave old access behind.
System for Cross-domain Identity Management (SCIM) standardizes account and group provisioning over Hypertext Transfer Protocol (HTTP). An identity system can create a user record, update profile attributes, add or remove group memberships, and disable an account when access should end.
SCIM is useful because lifecycle changes can flow from a central source of truth to many applications. If an employee leaves, the organization can disable the account instead of waiting for someone to clean up each application manually. Group changes can also drive application roles when the application maps those groups into its own authorization model.
Provisioning is not the same as authentication. A SCIM record does not prove that the person currently signing in is that user. Single sign-on handles sign-in, while SCIM handles account state and assignments. Both are needed in many enterprise environments because an account that should no longer exist must not remain usable simply because authentication still works.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.