🔗System for Cross-domain Identity Management

NEW

Also known as: SCIM

An open standard for automating user identity provisioning and management across systems via RESTful APIs and standardized schemas.

DESCRIPTION

SCIM standardizes identity provisioning through REST APIs and JSON schemas for users and groups. It enables automated lifecycle management—create, update, deactivate—between identity providers and SaaS applications. The standard reduces custom connectors and speeds onboarding and offboarding. SCIM complements protocols like SAML and OIDC that handle authentication and federation. Major identity platforms and SaaS vendors support SCIM for interoperability and compliance.

ALTERNATIVE DEFINITIONS

IETF RFC 7644

The SCIM protocol is an application-level, REST protocol for provisioning and managing identity data on the web.

Formal definition emphasizing REST protocol for identity provisioning.

Source

Microsoft Learn

System for Cross-domain Identity Management (SCIM) is a standard for automating the exchange of user identity information between identity domains or IT systems.

Highlights automation of identity data exchange across domains.

Source

Okta

SCIM is a standard designed to make managing user identities in cloud-based applications and services easier.

Emphasizes simplification for cloud app identity management.

Source

RELATED TERMS

Identity Management User Provisioning Directory Service SAML OAuth 2.0 OpenID Connect RBAC Zero Trust Lifecycle Management SCIM Schema

COMPETING TERMS

LDAP Service Provisioning Markup Language

KNOWLEDGE AREAS

Data Security Data Integration & Interoperability Cloud Platform & Tooling

TARGET AUDIENCE

DevOps Engineer Cloud Architect Software Developer Chief Information Officer MLOps Engineer

EXTERNAL SOURCES

• Wikipedia - System for Cross-domain Identity Management
• IETF - SCIM core schema specification
• IETF - SCIM protocol specification
• Microsoft - How to use SCIM for provisioning
• Okta - Developer overview of SCIM

TOP QUESTIONS

How does SCIM differ from SAML and OIDC?

SCIM handles identity lifecycle provisioning via REST APIs. SAML and OIDC handle authentication and federation, not account creation or deprovisioning.

Category: Misunderstanding

What problems does SCIM solve?

It reduces bespoke connectors, accelerates onboarding/offboarding, and improves consistency of user attributes across SaaS applications.

Category: Relevancy

What are core SCIM resources?

User and Group are core, extendable via custom schemas. Standardized attributes promote interoperability.

Category: Concept

How is SCIM secured?

Commonly via OAuth 2.0 bearer tokens over HTTPS. Implement least privilege scopes and rotate secrets.

Category: Security

What is a common SCIM implementation mistake?

Ignoring PATCH semantics and treating updates as full replacements can cause attribute loss.

Category: Mistakes

How does SCIM support compliance?

Automated deprovisioning reduces orphaned accounts, aiding least privilege and auditability.

Category: Compliance

Who typically implements SCIM?

Identity providers (e.g., Microsoft Entra ID, Okta) and SaaS vendors exposing SCIM endpoints for provisioning.

Category: Roles

Is SCIM bidirectional?

Often yes: IdPs push users to apps; apps can expose discovery and support query for reconciliation.

Category: Concept

What are SCIM version differences?

SCIM 2.0 (RFC 7643/7644) is widely adopted, improving schemas and protocol over earlier drafts.

Category: Standard