Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
A SCIM connection links one Living Security organization to one identity provider (IdP). The connection has a regional base URL and a token. Your IdP sends the token with every request.

What you need

  • Permission to manage SSO and SCIM settings (the identity-provider permission). Every action on this page needs it and is recorded in the audit log.
  • An administrator of your IdP, or a setup link you send to one.
  • SSO is not required. See SSO, multiple connections and sub-organizations.

Find the SCIM card

Depending on your settings layout, open one of:
  • Settings → Privacy & security → Directory sync (SCIM). The connection is under Source, titled Living Security SCIM.
  • Settings → Sign-in & SSO → Overview, in the SCIM provisioning card.
Both show the same connection. A sub-organization that uses its parent organization’s SSO does not get its own Living Security SCIM connection. See Sub-organizations.

Create the token

1

Set up SCIM

On the SCIM card, select Set up SCIM.
2

Copy the credentials

The Copy your SCIM credentials dialog shows the SCIM base URL and the Bearer token. Copy both into your IdP’s provisioning settings.
You can’t see this token again. If you lose it, rotate the token.
3

Close the dialog

Select I’ve copied the token. The card now shows the Base URL, the last four characters of the token, and its expiry date.
4

Configure your IdP

Follow the guide for your IdP: Microsoft Entra ID, Okta, OneLogin, JumpCloud, PingOne or PingFederate, SailPoint or Google Workspace. For another SCIM 2.0 IdP, follow Set up SCIM with another SCIM 2.0 client.
You do not need to sign in again to create, rotate or revoke a token. Your normal session is enough.

Move from the earlier SCIM setup

If your organization already provisions people through the earlier SCIM setup, the SCIM card says that your current SCIM connection will be turned off automatically. An admin makes the move on the card. You do not need to contact Living Security.
1

Start the move

On the SCIM card, select Set up SCIM. Living Security copies your current SCIM users and groups. This usually takes a few minutes. You can leave the page. The earlier connection keeps working while the copy runs.
2

Copy the credentials

When the copy is complete, the Copy your SCIM credentials dialog opens. If you left the page, open the SCIM card again and select Set up SCIM. If some records could not be copied, because another record has the same user name or external ID, or a required value is missing, the card shows how many and asks you to select Continue setup. A record that was not copied does not exist in Living Security SCIM yet, so your IdP’s next update to it can fail with 404. Fix the duplicate or missing value in your IdP. Then check Troubleshoot SCIM → Health after the first sync. If a person who was not copied still fails, remove them from the Living Security app’s scope in your IdP, let one sync run, and add them back. Your IdP then creates the SCIM user again, and Living Security links it to the existing person by email. If that does not work, contact Living Security support with the request ID from Copy diagnostics.
3

Update your existing IdP application

In the IdP application you use today, replace the SCIM base URL (tenant URL) and the token with the new ones. Do not create a new application, and do not assign people again. The copy keeps the user and group IDs your IdP has stored.
4

Let your IdP send a change

The first change your IdP sends with the new token, such as creating or updating a person, turns the earlier connection off automatically. A connection test does not turn it off. People keep their accounts and sign in the same way. After that change, the card’s Mode row says Native SCIM.
A setup link (see Send a setup link to your IT administrator) can create the token only after the copy is complete.

The token

  • A token looks like lsscim_<region>_<key ID>_<secret>_<checksum>. The fixed lsscim_ prefix and the checksum let secret scanners find a token that leaks into code or logs.
  • Living Security stores only a hash of the token.
  • A token works only on its own region’s base URL.

Expiry and notices

A token created on the SCIM card expires after one year. By default, Living Security sends expiry notices 30, 14, 7 and 1 days before. The notices use the same settings (days, recipients and channels) as API access key notices. No notice is sent while a rotation is open. The Health tab also warns you: Token expires soon, then Token expired. An expired token stops working. Your IdP’s requests then fail with 401, and no one is created, changed or deactivated. Rotate the token before it expires.

Rotate the token

Rotation replaces the token without a gap in provisioning.
  1. Select Rotate token and confirm. The card shows the new token once. Copy it.
  2. Put the new token in your IdP. Both tokens work until you finish the rotation. The card shows whether your IdP has used the new token yet.
  3. Select Finish rotation. The old token stops working at once. If your IdP has not used the new token yet, the confirmation warns you.
Select Cancel rotation to keep the old token and discard the new one. The rotation has no time limit, but each token still stops at its own expiry date.

Revoke

Select Revoke and confirm. Your IdP can no longer create, update or deactivate accounts. People who already exist stay as they are. To connect again, select Set up SCIM. The person who configures your IdP does not need a Living Security account. Send them a setup link.
  1. On the SCIM card, in the Setup link row, select Create setup link.
  2. Copy the link from the Copy the setup link dialog, then select I’ve copied the link. You can’t see the link again.
  3. Send the link to your IT administrator over a channel you trust.
The link opens a Set up SCIM for page for your organization only. It shows the SCIM base URL, a setup checklist with steps for Microsoft Entra ID and Okta, and a button to create a SCIM token.
  • The link works for 7 days. The card shows the date.
  • Your organization has one setup link at a time. Create new link replaces the old one.
  • Select Revoke link to end it early.
  • If a token already exists, the link can only start a rotation. The current token keeps working until an administrator selects Finish rotation on the SCIM card.
  • The link can do nothing else. It cannot read people, change settings or finish a rotation.
  • Every link created, revoked and used is recorded in the audit log.

Authentication methods

The SCIM card creates bearer tokens. Living Security SCIM also accepts HTTP Basic authentication and OAuth 2.0 client credentials for IdPs that cannot send a bearer token. These methods are not on the SCIM card. If your IdP cannot send a bearer token, contact Living Security support. See API reference: Authentication.

Check the connection

Select Troubleshoot SCIM on the SCIM card. The page has four tabs: The SCIM card also shows the Mode, the Last request and the count of Held accounts. Held accounts are explained in Held changes. Copy diagnostics on the troubleshooting page copies connection IDs, request IDs and error codes for a support request. It never includes names, email addresses or tokens.