> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Users

> Use SCIM to standardize the process of granting and removing individual user access to Connect AI.

The System for Cross-domain Identity Management (SCIM) is a standard for managing user provisioning, updates, and deletions in cloud-based applications. It allows you to use your company's identity provider, such as Okta or Entra ID, to provision, update, and delete users securely in Connect AI.

## Prerequisites

* **SSO** must be configured on your Connect AI account before you can enable SCIM Users.
* **SCIM Users** must be enabled on your account. Contact [CData Support](https://www.cdata.com/support/submit.aspx) to enable SCIM Users.
* **Microsoft Entra ID license requirement** *(Entra ID only)*: Automated SCIM provisioning requires Microsoft Entra ID Premium P1 or P2 (included with Microsoft 365 E3/E5). Organizations on the Entra ID free tier cannot configure automated provisioning.

Connect AI supports SCIM provisioning with the following identity providers:

* Microsoft Entra ID
* Okta Workforce Identity Cloud
* Custom IdP (configured via SAML or OpenID Connect)

The following SCIM providers are NOT supported:

* PingFederate
* Google Workspace
* Active Directory Federation Services (ADFS)
* Active Directory/LDAP

## Configure SCIM User Provisioning in Your Identity Provider

When CData Support enables SCIM for your account, they provide a unique SCIM endpoint URL and Bearer token. Use these credentials to connect your identity provider to Connect AI.

The steps below walk through the full SCIM user configuration for Microsoft Entra ID and Okta Workforce Identity Cloud.

<Tabs>
  <Tab title="Entra ID">
    <Note>
      **Connect AI does not appear in the Entra application gallery.** Create a new application from the gallery.
    </Note>

    <Steps>
      <Step>
        From the [Microsoft Entra admin center](https://entra.microsoft.com), navigate to **Enterprise apps** > **+ New application**. Click **Create your own application**, enter a name for the application (for example, *Connect AI SCIM*), select **Integrate any other application you don't find in the gallery (Non-gallery)**, and click **Create**.
      </Step>

      <Step>
        In the navigation menu, under **Manage**, select **Properties**. Set **Assignment required** to **Yes** and click **Save**.
      </Step>

      <Step>
        In the navigation menu, under **Manage**, select **Users and groups**. Assign the users and groups you want to provision to Connect AI. When you assign a group, the users from that group are provisioned automatically.
      </Step>

      <Step>
        In the navigation menu, under **Manage**, select **Provisioning** and click **Get started**.
      </Step>

      <Step>
        Set **Provisioning Mode** to **Automatic**.
      </Step>

      <Step>
        Under **Manage**, select **Connectivity** and configure the following parameters:

        * **Tenant URL**—enter the SCIM endpoint URL provided by CData Support and append `?aadOptscim062020` to the end of the URL. This is Microsoft's recommended workaround for a known SCIM 2.0 issue.
        * **Secret Token**—enter the Bearer token provided by CData Support.

        Click **Test Connection**.
      </Step>

      <Step>
        Under **Manage**, select **Attribute Mapping**, then select the **Users** tab. In the row containing `mail` and `emails[type eq "work"].value`, click the Edit icon and configure the following:

        * Set **Match objects using this attribute** to **Yes**.
        * Set **Matching precedence** to **2**.

        Click **Apply** to save, then click **Save** on the Attribute Mapping page.

        <Note>If users in your organization do not have the `mail` attribute populated in Entra ID, edit the same row and change **Source attribute** to `userPrincipalName` to ensure the email field is always populated during provisioning.</Note>
      </Step>

      <Step>
        On the main Enterprise application page, select **Provision on demand**. Search for and select a user you assigned, then click **Provision**. Verify that the user appears in Connect AI.
      </Step>

      <Step>
        Under **Provisioning**, set **Provisioning Status** to **On** to begin provisioning all assigned users and groups.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Okta">
    <Steps>
      <Step>
        In the Okta Admin Console, navigate to **Applications** > **Browse App Catalog**. Search for **(OAuth Bearer Token) Governance with SCIM 2.0** and click **Add Integration**. Set an **Application label**, uncheck **Display application icon to users**, uncheck **Browser plugin auto-submit**, then click **Next** and **Done**.
      </Step>

      <Step>
        From the application settings page, click the **Provisioning** tab and click **Configure API Integration**. Select **Enable API Integration**. Enter the following values provided by CData Support:

        * **SCIM 2.0 Base URL**—the SCIM endpoint URL (remove any trailing slash)
        * **OAuth Bearer Token**—the Bearer token

        Optionally click **Test API Credentials** to verify the connection, then click **Save**.
      </Step>

      <Step>
        Next to **Provisioning to App**, click **Edit**. Enable the following features:

        * **Create Users**
        * **Update User Attributes**
        * **Deactivate Users**

        Uncheck **Set password when creating new users**, then click **Save**.
      </Step>

      <Step>
        Under **Attribute Mappings**, use the **X** button to delete the following rows, which can cause issues during updates:

        * **Primary email type**
        * **Primary phone type**
        * **Address type**
      </Step>

      <Step>
        Select the **Assignments** tab. Click **Assign** and select the users to provision to Connect AI.

        <Note>You must assign the same users to both the SCIM application and your SSO application in Okta.</Note>
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Direct API Provisioning, Updates, and Deprovisioning

In addition to IdP-based provisioning, you can manage users directly via the SCIM API. CData Support supplies a unique base URL following this format: `https://{your-domain.com}/scim/v2`. The URL endpoint contains the necessary user metadata. All SCIM endpoints require an `Authorization` header with a `Bearer` token.

To provision a new user, `POST` to your unique SCIM endpoint. The system provisions the user in Connect AI. There is no need for the user to verify via email. The new user has a default system role of Query user. See [Roles](/en/Roles) for details on system roles. The new user only has access to connections that have user-defined credentials turned on.

To update a SCIM user's name and email, use `PATCH` with the SCIM endpoint. When a SCIM update user request comes in, the system updates the information in Connect AI.

To delete a user, use `DELETE` and your unique SCIM endpoint. The SCIM delete event calls the delete endpoint. For complete deprovisioning, also call `DELETE /users/{id}` from the Management API to revoke PATs and any direct role and permission grants.

The Connect AI [Audit Log](/en/Logs#audit-log) displays SCIM user provisioning, updates, and deletions.

## Roles and Permissions

A user's access in Connect AI is the combination of group-derived roles (from SCIM group assignments), direct role assignments, and direct resource permissions. You can manage direct assignments and fully deprovision users using the Management API (base path `/api/v1/`):

| Method | Path | Description |
| - | - | - |
| `GET` | `/users` | List all users |
| `GET` | `/users/{id}` | Get a single user including their direct permissions |
| `PATCH` | `/users/{id}` | Update user attributes |
| `DELETE` | `/users/{id}` | Deprovision: revoke all PATs and remove all direct role and permission grants |
| `POST` | `/users/{id}/roles` | Assign a role directly to a user |
| `GET` | `/users/{id}/roles` | List all roles assigned to a user, showing whether each was assigned directly or inherited from a group |
| `DELETE` | `/users/{id}/roles/{role_id}` | Remove a direct role assignment |
| `POST` | `/users/{id}/permissions` | Assign a resource permission directly to a user |
| `GET` | `/users/{id}/permissions` | List direct permissions assigned to a user |
| `DELETE` | `/users/{id}/permissions/{permission_id}` | Remove a direct permission |

See [Roles](/en/Roles) for details on system and access roles.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.