Enterprise
SCIM
System for Cross-domain Identity Management — a standard API for provisioning and de-provisioning users automatically.
What SCIM means
SCIM is how an enterprise's directory keeps your application's user list in sync automatically. When someone joins, a user is created; when they leave, it is deactivated. Without it, de-provisioning depends on somebody remembering.
Defined in: RFC 7643 (schema) and RFC 7644 (protocol).
How it works
It defines a REST API with a standard user schema, so an identity provider can create, update, deactivate and query users in any application that implements it, without custom integration per application.
The security value is almost entirely in de-provisioning. Creating accounts manually is annoying; failing to remove them is a finding in every access review and the reason dormant accounts of former employees are a recurring breach vector.
It is frequently requested alongside SAML, and for the same reason: both are what an enterprise identity team needs to manage your application the way it manages everything else.
The mistake people actually make
Implementing create and update but treating deactivation as optional. That is the operation the standard is actually valuable for, and the one an access review will test.
In Authreads
How this applies here
SCIM is on the roadmap as Planned. Tenant and user management through the management API is available today, which is not the same thing.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Related terms
SAML
An XML-based federation standard, still the default for enterprise single sign-on.
Single sign-on (SSO)
Authenticating once with a central provider and gaining access to multiple applications.
Machine identity
Credentials issued to a service, workload or agent rather than to a person.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.