SCIM provisioning

SCIM (System for Cross-domain Identity Management) lets a customer's identity provider push user lifecycle changes to Atlas automatically. When an employee joins, changes teams or leaves, their access to your product updates without anyone touching your dashboard.

What SCIM automates

• Provisioning — a new employee assigned to your app in the IdP is created as an Atlas user and added to the customer's organization.

• Updates — profile and group changes flow through (e.g. a promotion that changes their role).

• De-provisioning — when an employee is offboarded in the IdP, their Atlas access is deactivated. This is the feature security teams care about most: no lingering accounts after someone leaves.

Setting it up

1. On the customer's organization, open the SCIM tab (available once an enterprise connection exists).

2. Atlas generates a SCIM base URL and a bearer token.

3. Share these with the customer's IdP admin, who configures provisioning in their IdP's app settings.

4. Map IdP groups → Atlas roles so provisioned users get the right permissions.

5. Trigger an initial sync and confirm users appear in the org.

JIT vs SCIM

• Just-in-time (JIT) provisioning creates a user the first time they sign in via SSO. Good enough for many customers.

• SCIM provisions and, crucially, de-provisions ahead of sign-in — the right choice for enterprises with strict offboarding requirements.

You can use JIT alone, or JIT plus SCIM together.

Security

The SCIM bearer token is sensitive — it can create and remove users in the org. Atlas stores it encrypted, lets you rotate it, and records every SCIM change in the audit log.

Next

Make the whole experience look like your product → Branding & appearance.