SCIM (System for Cross-domain Identity Management)
An open standard for automating the exchange of user identity information between identity providers (IdPs) and service providers. Used for just-in-time user provisioning and deprovisioning.
SCIM (System for Cross-domain Identity Management) is an open standard (RFC 7643 / RFC 7644) that defines a REST API for exchanging user identity information between an identity provider (IdP) and a service provider (SP).
What SCIM automates
- Provisioning: When a new employee joins and is added to the company IdP (Okta, Azure AD, etc.), SCIM creates their account in your SaaS automatically.
- Deprovisioning: When an employee leaves, SCIM deactivates their account — no forgotten access.
- Group sync: IdP groups map to roles in your application. Changing a user's group in Okta updates their access in your app.
Why enterprise customers require SCIM
Enterprise IT teams manage hundreds or thousands of SaaS apps. Manual onboarding for each app is impractical and creates security gaps (off-boarded employees with lingering access). SCIM is a security and compliance requirement for most mid-to-large enterprise customers.
SCIM in WardenAuth
WardenAuth's Enterprise tier includes a SCIM 2.0 server. Connect your identity provider (Okta, Azure AD, Google Workspace) to the SCIM endpoint, and user provisioning and deprovisioning happens automatically. SCIM tokens are managed from the Enterprise settings page.
Related terms
A logical isolation boundary in a multi-tenant system. Permissions, roles, and access policies in one scope are completely independent from those in another.
Custom claims embedded in JSON Web Tokens that carry identity and context for authorization decisions. Often used to pass scopeId, orgId, or role hints to services.