Set up SCIM provisioning
Updated Reading time: 4 min
On this page
With SCIM, your identity management system—such as Microsoft Entra ID, Okta, or Keycloak—creates accounts and groups in Kibi Connect, keeps names and contact details up to date, and locks accounts as soon as someone leaves the company.
Info
Prerequisite: An identity source under Administration → Integrations → SSO & Directory. Only system admins can set up SCIM.
Enable SCIM#
Under SSO & Directory, open the desired identity source.
Switch to the User Sync tab and click Enable SCIM.
Copy the SCIM endpoint and the SCIM token into your identity management system.
The endpoint always follows this pattern:
https://<your platform address>/scim/v2 – for example, https://company.kibi.de/scim/v2
Warning
The token is displayed only once. Copy it immediately into your identity management system—later, it can only be renewed.
With Renew Token, you get a new token; the previous one stops working immediately. Disable SCIM deletes the token, but existing accounts remain.
The IP allowlist of the REST API also applies to SCIM. If your identity management system has not accessed it for 48 hours, the SCIM status in the tab will indicate this.
Set up in Microsoft Entra ID#
Info
If you already use Microsoft Entra ID directory sync, you do not need SCIM. SCIM is an alternative if you prefer to provision accounts from Entra.
In the Microsoft Entra Admin Center, open Enterprise Applications → New Application → Create Your Own Application (not from the catalog).
Select Provisioning and set the mode to Automatic.
Enter the SCIM endpoint as the Tenant URL and the SCIM token as the Secret Token. Click Test Connection.
Map the attributes: userPrincipalName or mail → userName, objectId → externalId, active as preset. Phone, position, and other details as needed.
Assign users and groups and start provisioning—or test it first with On-Demand Provisioning for a single person.
Set up in Okta#
Create an app integration (SAML or OIDC) and enable SCIM provisioning.
Under Provisioning → Integration, enter the SCIM endpoint as the SCIM connector base URL and userName as the Unique identifier field.
Select the actions Push New Users, Push Profile Updates, and Push Groups, and for authentication, choose HTTP Header with the SCIM token.
Under To App, enable the options Create Users, Update User Attributes, and Deactivate Users.
What is transferred#
Information from identity management |
Field in Kibi Connect |
|---|---|
First name, last name |
First name, last name |
userName with @ |
Email address (login via email) |
userName without @ or employeeNumber |
Username, e.g., employee number |
title |
Position |
Phone (work) and mobile (mobile) |
Phone and mobile (business) |
active |
Account active or locked |
As long as SCIM is enabled, these fields in the profile are locked. You can disable this per identity source with Lock fields maintained by the directory—they will then remain editable, but the next sync will overwrite them again. New accounts are always employees, never guests; if all licenses are in use, no account will be created, and system admins will be notified.
Settings in the "User Sync" tab#
-
When a person is removed from identity management
"Lock account" (recommended): The account remains with all its content, but the person can no longer log in. "Delete account": The account is deleted and can be restored for a limited time.
-
Send welcome email to new accounts
People created via SCIM receive an email with a link to the login page. They then log in via your identity provider.
-
Groups from identity management
If your identity management transfers groups, they become groups in Kibi Connect. Their members are managed exclusively by the identity management. With "Link existing group," you transfer an existing group—content and members remain intact. If the identity management removes a group, only the link is removed.
-
Assign roles via groups
Members of a group automatically receive the assigned roles and lose them when leaving the group. Manually assigned roles remain unaffected. Roles with admin rights cannot be assigned.
Security features#
Confirmation for admin accounts#
A compromised SCIM token must not be enough to take over your platform. Therefore, the platform waits for the consent of the affected person before the identity management
takes over an existing admin account or
changes the email address of an admin account.
The person receives an email at their current address—never at the new one.
Via the link, they open a page, log in with their account, and select "Confirm" or "Reject." Clicking the email link alone does nothing.
The request is valid for 7 days. If it is rejected or expires, the remaining system admins receive a notification.
All other account details are adopted by the platform immediately. Pending requests can be seen in the "User Sync" tab under "Pending Confirmations." The same confirmation applies to directory sync with Microsoft Entra ID.
Warning
If no one initiated the change in identity management, renew the SCIM token and check who had access to it.
Limit against mass offboarding#
If an identity management system attempts to lock or delete more than 50% of the accounts it manages within 24 hours (at least 10 accounts), a misconfiguration is usually the cause—such as an accidentally restricted assignment. The platform then stops further deactivations from this source:
The affected accounts remain active.
System admins receive a notification and an email "Mass deactivation via SCIM stopped."
Your identity management will try again later; until then, the stop remains in place.
If the deactivation is intentional, such as during a restructuring, contact support. The limit can then be lifted once. If Microsoft Entra ID has since placed provisioning under quarantine, restart it in Entra afterward.
The last system admin remains active#
The last active system admin of your platform can never be locked or deleted via SCIM. The platform rejects such a change and logs it.
Info
Recommendation: Keep at least one system admin that is not managed by identity management, or appoint a second one before connecting SCIM.