Protocols and how-tos
SCIM provisioning explained: automating user lifecycle for B2B
How SCIM 2.0 lets a customer's directory create, update and deactivate users in your product, which endpoints matter, and why deprovisioning is the point.
The short answer
SCIM 2.0 (RFC 7643 and RFC 7644) is a REST and JSON standard that lets an enterprise directory create, update and deactivate users and groups in your application automatically. Its main value to customers is deprovisioning: when someone leaves, their access to your product ends without a manual step.
Sources last reviewed .
What you implement
Your product exposes a SCIM service provider: /Users and /Groups resources supporting create, read, replace or patch, delete and filtered search, plus /ServiceProviderConfig, /Schemas and /ResourceTypes for discovery. The customer's directory is the client and authenticates with a bearer token you issue per tenant.
Details that break integrations
- PATCH semantics (RFC 7644 section 3.5.2) — directories differ in how they send operations; test against the ones your customers use.
- Filtering on userName eq "..." must work, because directories use it to check for existing users before creating them.
- Deactivation usually arrives as active=false rather than DELETE; it must end sessions and revoke tokens, not just set a flag.
- externalId is the directory's identifier; store it and never treat email as immutable.
SCIM and SSO together
SSO answers 'who is signing in'. SCIM answers 'who should exist at all'. Without SCIM, a departed employee's account stays in your product until someone notices — the SSO login fails, but API tokens and existing sessions may not.
In Authreads
How this applies to Authreads
SCIM is Planned on the Authreads roadmap. Tenant and user management through the management API is available today, which is not the same thing.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Protocols and how-tos
SAML SSO for B2B SaaS: what enterprise customers will ask for
Multi-tenant architecture
Per-tenant SSO: routing each customer to their own identity provider
Security
Session management best practices for web applications
Glossary: SCIM · Single sign-on (SSO) · SAML · Session revocation
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.