SCIM 2.0

How does SCIM 2.0 provision users and groups between systems?

System for Cross-domain Identity Management - RFC 7642, 7643, 7644

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

User Lifecycle

Complete user provisioning lifecycle covering the four core SCIM operations: Create (POST), Update (PATCH), Deactivate (PATCH active=false), and Delete (DELETE) as defined in RFC 7644 §3. This flow represents the standard identity lifecycle pattern used by IdPs like Okta, Azure AD, and OneLogin to synchronize user accounts to downstream applications.

View flow diagram

Group Membership Management

Create and manage groups with member add/remove operations using SCIM PATCH (RFC 7644 §3.5.2). Groups use the urn:ietf:params:scim:schemas:core:2.0:Group schema and contain a multi-valued 'members' attribute referencing User resources by their SCIM ID.

View flow diagram

User Discovery with Filters

Query and discover users using SCIM filter expressions, pagination, and attribute projection (RFC 7644 §3.4.2). SCIM filtering uses a SQL-like syntax supporting comparison operators (eq, ne, co, sw, ew, gt, lt, ge, le), presence checks (pr), and logical operators (and, or, not).

View flow diagram

Bulk Operations

Execute multiple SCIM create, update, patch, and delete operations in a single HTTP request (RFC 7644 §3.7). Bulk operations reduce round trips and enable atomic provisioning of related resources. The server advertises its bulk capabilities (maxOperations, maxPayloadSize) via the ServiceProviderConfig endpoint.

View flow diagram

Schema Discovery

Discover SCIM server capabilities, supported resource types, and full schema definitions using the three discovery endpoints defined in RFC 7644 §4. These endpoints allow clients to dynamically adapt to server capabilities without hardcoding assumptions about supported features, attributes, or extensions.

View flow diagram

Specs & references

Authoritative reading list for SCIM 2.0 — core specs, security considerations, and companion standards.

Core specs

· The specifications that define this protocol.

Security & privacy

· Dedicated security and privacy considerations.

SCIM 2.0 Features

User Provisioning

Automated user account creation and management

Group Management

Sync groups and memberships between IdP and SP

Filter Queries

RFC 7644 compliant filter syntax for queries