# SCIM provisioning > SCIM provisioning - Configure SCIM to enable automated user provisioning and deprovisioning in > DataRobot through your identity provider. This Markdown file sits beside the HTML page at the same path (with a `.md` suffix). It summarizes the topic and lists links for tools and LLM context. Companion generated at `2026-10-23T15:20:59.369582+00:00` (UTC). ## Primary page - [SCIM provisioning](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md): Full documentation for this topic (Markdown sidecar). ## Sections on this page - [Authentication](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#authentication): In-page section heading. - [Prerequisites](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#prerequisites): In-page section heading. - [DataRobot configuration](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#datarobot-configuration): In-page section heading. - [Enable and configure SCIM](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#enable-and-configure-scim): In-page section heading. - [Create a SCIM API key](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#create-a-scim-api-key): In-page section heading. - [Configure the IdP](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#configure-the-idp): In-page section heading. - [Validation](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#validation): In-page section heading. - [Verify SCIM connectivity](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#verify-scim-connectivity): In-page section heading. - [Verify org configuration](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#verify-org-configuration): In-page section heading. - [Test user provisioning](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#test-user-provisioning): In-page section heading. - [Deactivate, release, and delete SCIM-managed users](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#deactivate-release-and-delete-scim-managed-users): In-page section heading. - [When the IdP deactivates a user](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#when-the-idp-deactivates-a-user): In-page section heading. - [Release a user from SCIM management](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#release-a-user-from-scim-management): In-page section heading. - [Delete a released user](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#delete-a-released-user): In-page section heading. ## Related documentation - [Account management](https://docs.datarobot.com/en/docs/platform/index.html.md): Linked from this page. - [Administrator's guide](https://docs.datarobot.com/en/docs/platform/admin/index.html.md): Linked from this page. - [Security](https://docs.datarobot.com/en/docs/platform/admin/security/index.html.md): Linked from this page. - [SAML single sign-on](https://docs.datarobot.com/en/docs/platform/admin/security/sso-ref.html.md): Linked from this page. - [seat license](https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-users.html.md#assign-seat-licenses-to-users): Linked from this page. - [Permanently delete an account](https://docs.datarobot.com/en/docs/platform/admin/inactive-accounts.html.md#permanently-delete-an-account): Linked from this page. ## Documentation content System for Cross-domain Identity Management (SCIM) automates user provisioning and deprovisioning in DataRobot through your identity provider (IdP). With SCIM configured, the IdP manages user lifecycle events, so org admins are not required to manually add, move, or remove an employee in DataRobot. IT admins still retain full control over what groups are synced with DataRobot—only explicitly selected groups are provisioned, not the entire directory. **Why use SCIM?** - Realtime visibility into who has access to DataRobot. - Automatically provisions new users joining the company and removes users leaving the company, reducing security risks. - Scales as organizations grow. - Takes the burden off IT and security teams to manually manage user accounts and groups. - Reduces the potential for over-provisioning and under-provisioning. The basic workflow for configuring SCIM is as follows: 1. Review and complete the prerequisites. 2. Enable SCIM and configure SCIM for the organization. 3. Create a SCIM API key. 4. Configure your identity provider (IdP). 5. Validate the integration. ## Authentication SCIM uses OAuth Bearer Token authentication ( [RFC 6750](https://datatracker.ietf.org/doc/html/rfc6750)). Include the SCIM API key in every request as: ``` Authorization: Bearer ``` Store the SCIM key in your IdP's SCIM connector as the API token or bearer token. **Properties of SCIM keys** - SCIM keys do not expire. - A SCIM key is organization-scoped, meaning it authenticates SCIM operations for one specific organization. - The key provides access to all SCIM resource endpoints ( /api/v2/scim//Users , /api/v2/scim//Groups , etc.). - The key does not have access to the SCIM configuration endpoint ( /api/v2/scim//configuration/ ); that endpoint requires organization admin authentication via a standard DataRobot API key. ## Prerequisites Before configuring SCIM, SAML SSO must be enabled for the organization. To configure SSO, see [SAML single sign-on](https://docs.datarobot.com/en/docs/platform/admin/security/sso-ref.html.md). Attempting to enable SCIM without SSO configured returns: ``` 400 Bad Request: SSO must be enabled for the organization before configuring SCIM ``` ## DataRobot configuration Complete the following sections in order. ### Enable and configure SCIM To enable and configure SCIM for the organization: 1. In Admin settings , go to your organization, and click SCIM . 2. Toggle onEnable SCIM. 3. Configure the following fields: FieldDescriptionExternal IdP typeThe identity provider (Okta or Microsoft Entra ID).Default seat licenseTheseat licensetype automatically assigned to new SCIM-provisioned users. Only licenses allocated to the cluster are listed. To opt out of auto-assignment, leave this field blank. ### Create a SCIM API key > [!NOTE] Note > Only a system or organization administrator can create a SCIM API key for the target organization. To create a SCIM API key: 1. OpenUser settings > API keys and tools. Click theSCIM API keystab. 2. Click+ Create new key. Enter a name and target organization, then clickCreate. The generated key is used as the Bearer token in the IdP's SCIM connector. DataRobot recommends having only one SCIM key per organization. ### Configure the IdP Provide the following to your IdP's SCIM connector: | Setting | Value | | --- | --- | | SCIM base URL | The integration endpoint from the SCIM configuration page (i.e, https://app.datarobot.com/api/v2/scim/6a2beff693648a4c1f6e2927/). | | Authentication type | OAuth Bearer Token | | Bearer token | The SCIM API key an admin created for the organization. | | SCIM version | 2.0 | For IdP-specific setup steps, refer to your provider's documentation: - Okta: Configure SCIM provisioning. - Microsoft Entra ID: SCIM provisioning. ## Validation The following sections test if the SCIM integration is configured correctly and performing as expected: ### Verify SCIM connectivity Use the SCIM API key to call the `ServiceProviderConfig` discovery endpoint: ``` curl -o /dev/null -s -w "%{http_code}\n" \ -H "Authorization: Bearer " \ https:///api/v2/scim//ServiceProviderConfig ``` Expected result: `200` | Status | Meaning | | --- | --- | | 200 | SCIM is enabled and the key is valid. | | 401 | Invalid or missing SCIM key. | | 404 | SCIM is not enabled for this organization. | ### Verify org configuration Use an organization administrator token to confirm the current SCIM configuration: ``` curl -s \ -H "Authorization: Bearer " \ https:///api/v2/scim//configuration/ ``` The response must contain: ``` { "scimEnabled": true, "idpType": "" } ``` If `scimEnabled` is `false` or `idpType` is `null`, return to the section on [enabling SCIM](https://docs.datarobot.com/en/docs/platform/admin/security/scim.html.md#enable-and-configure-scim). ### Test user provisioning Trigger a test provisioning event from the IdP. For example, assign a test user to the SCIM application in Okta or Entra ID. Check the IdP's provisioning logs to confirm the event was sent and received a `201 Created` response. ## Deactivate, release, and delete SCIM-managed users The IdP owns the lifecycle of every user it provisions. While a user is SCIM-managed, administrators cannot enable, disable, or delete the account in DataRobot, and cannot add the user to—or remove them from—SCIM-managed groups. ### When the IdP deactivates a user When the IdP deactivates a user (for example, when the user is unassigned from the SCIM application in Okta), DataRobot: - Disables the account. The account stays SCIM-managed, so the IdP can reactivate it later. - Frees the seat licenses assigned to the user. If the IdP reactivates the user, DataRobot restores the user if seats are still available. - Keeps the group memberships of the user. ### Release a user from SCIM management > [!NOTE] Note > Only a system administrator or an organization administrator of the organization the user belongs to can release a user. The IdP must have already deactivated the user. Releasing a user detaches the account from the IdP so that an administrator can delete it. Releasing also: - Removes the user from the organization's SCIM-managed groups. - Frees any seat licenses the user still holds. - Keeps the account disabled. To release a user: 1. In Admin settings > Users , open the profile of the deactivated SCIM-managed user. 2. ClickRelease from SCIM management. The action is disabled if the user is active. 3. In the confirmation dialog, clickRelease. To release a user with the API, send the following request with a system or organization administrator API key: ``` curl -X PATCH \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"clearScimProvisioning": true}' \ https:///api/v2/organizations//users// ``` Replace `` with the ID of the organization and `` with the ID of the user to release. The response status indicates the result: | Status | Meaning | | --- | --- | | 204 | The user is released from SCIM management. | | 422 | The user is active, is not SCIM-managed, or the request includes fields other than clearScimProvisioning. | If the IdP provisions the same user again, DataRobot re-links the account to the IdP and reactivates it. SCIM-managed group memberships return with the next group update from the IdP. ### Delete a released user A released user has an ordinary disabled account. Delete it from the user profile with Delete user. For more information, see [Permanently delete an account](https://docs.datarobot.com/en/docs/platform/admin/inactive-accounts.html.md#permanently-delete-an-account).