> ## Documentation Index > Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Set up a SCIM connection > Create the SCIM token, share a setup link with your IT administrator, rotate or revoke the token, and check the connection in Living Security SCIM. > [!NOTE] > > **Which SCIM setup applies to you?** These pages describe **Living Security SCIM**. Open the SCIM card in your settings. If the card shows **Set up SCIM**, or its **Mode** row says **Native SCIM**, these pages apply. If **Mode** says **Current SCIM**, your organization still uses the earlier SCIM setup. An admin can move it: see [Move from the earlier SCIM setup](https://docs.livingsecurity.com/features/settings/scim/connection.md#move-from-the-earlier-scim-setup). If the card says SCIM is set up and managed in the setup wizard, use [SCIM Provisioning](https://docs.livingsecurity.com/features/settings/scim.md). A SCIM connection links one Living Security organization to one identity provider (IdP). The connection has a regional base URL and a token. Your IdP sends the token with every request. ## What you need * Permission to manage SSO and SCIM settings (the identity-provider permission). Every action on this page needs it and is recorded in the audit log. * An administrator of your IdP, or a setup link you send to one. * SSO is not required. See [SSO, multiple connections and sub-organizations](https://docs.livingsecurity.com/features/settings/scim/sso-and-sub-organizations.md). ## Find the SCIM card Depending on your settings layout, open one of: * **Settings → Privacy & security → Directory sync (SCIM)**. The connection is under **Source**, titled **Living Security SCIM**. * **Settings → Sign-in & SSO → Overview**, in the **SCIM provisioning** card. Both show the same connection. A sub-organization that uses its parent organization's SSO does not get its own Living Security SCIM connection. See [Sub-organizations](https://docs.livingsecurity.com/features/settings/scim/sso-and-sub-organizations.md#sub-organizations). ## Create the token **1. Set up SCIM** On the SCIM card, select **Set up SCIM**. **2. Copy the credentials** The **Copy your SCIM credentials** dialog shows the **SCIM base URL** and the **Bearer token**. Copy both into your IdP's provisioning settings. > [!WARNING] > > You can't see this token again. If you lose it, rotate the token. **3. Close the dialog** Select **I've copied the token**. The card now shows the **Base URL**, the last four characters of the token, and its expiry date. **4. Configure your IdP** Follow the guide for your IdP: [Microsoft Entra ID](https://docs.livingsecurity.com/features/settings/scim-microsoft-entra-id.md), [Okta](https://docs.livingsecurity.com/features/settings/scim-okta.md), [OneLogin](https://docs.livingsecurity.com/features/settings/scim-onelogin.md), [JumpCloud](https://docs.livingsecurity.com/features/settings/scim-jumpcloud.md), [PingOne or PingFederate](https://docs.livingsecurity.com/features/settings/scim-ping.md), [SailPoint](https://docs.livingsecurity.com/features/settings/scim-sailpoint.md) or [Google Workspace](https://docs.livingsecurity.com/features/settings/scim-google-workspace.md). For another SCIM 2.0 IdP, follow [Set up SCIM with another SCIM 2.0 client](https://docs.livingsecurity.com/features/settings/scim-generic.md). You do not need to sign in again to create, rotate or revoke a token. Your normal session is enough. ## Move from the earlier SCIM setup If your organization already provisions people through the earlier SCIM setup, the SCIM card says that your current SCIM connection will be turned off automatically. An admin makes the move on the card. You do not need to contact Living Security. **1. Start the move** On the SCIM card, select **Set up SCIM**. Living Security copies your current SCIM users and groups. This usually takes a few minutes. You can leave the page. The earlier connection keeps working while the copy runs. **2. Copy the credentials** When the copy is complete, the **Copy your SCIM credentials** dialog opens. If you left the page, open the SCIM card again and select **Set up SCIM**. If some records could not be copied, because another record has the same user name or external ID, or a required value is missing, the card shows how many and asks you to select **Continue setup**. A record that was not copied does not exist in Living Security SCIM yet, so your IdP's next update to it can fail with `404`. Fix the duplicate or missing value in your IdP. Then check **Troubleshoot SCIM → Health** after the first sync. If a person who was not copied still fails, remove them from the Living Security app's scope in your IdP, let one sync run, and add them back. Your IdP then creates the SCIM user again, and Living Security links it to the existing person by email. If that does not work, contact Living Security support with the request ID from **Copy diagnostics**. **3. Update your existing IdP application** In the IdP application you use today, replace the SCIM base URL (tenant URL) and the token with the new ones. Do not create a new application, and do not assign people again. The copy keeps the user and group IDs your IdP has stored. **4. Let your IdP send a change** The first change your IdP sends with the new token, such as creating or updating a person, turns the earlier connection off automatically. A connection test does not turn it off. People keep their accounts and sign in the same way. After that change, the card's **Mode** row says **Native SCIM**. A setup link (see [Send a setup link to your IT administrator](#send-a-setup-link-to-your-it-administrator)) can create the token only after the copy is complete. ### The token * A token looks like `lsscim____`. The fixed `lsscim_` prefix and the checksum let secret scanners find a token that leaks into code or logs. * Living Security stores only a hash of the token. * A token works only on its own region's base URL. ## Expiry and notices A token created on the SCIM card expires after one year. By default, Living Security sends expiry notices 30, 14, 7 and 1 days before. The notices use the same settings (days, recipients and channels) as API access key notices. No notice is sent while a rotation is open. The **Health** tab also warns you: **Token expires soon**, then **Token expired**. An expired token stops working. Your IdP's requests then fail with `401`, and no one is created, changed or deactivated. Rotate the token before it expires. ## Rotate the token Rotation replaces the token without a gap in provisioning. 1. Select **Rotate token** and confirm. The card shows the new token once. Copy it. 2. Put the new token in your IdP. **Both tokens work until you finish the rotation.** The card shows whether your IdP has used the new token yet. 3. Select **Finish rotation**. The old token stops working at once. If your IdP has not used the new token yet, the confirmation warns you. Select **Cancel rotation** to keep the old token and discard the new one. The rotation has no time limit, but each token still stops at its own expiry date. ## Revoke Select **Revoke** and confirm. Your IdP can no longer create, update or deactivate accounts. People who already exist stay as they are. To connect again, select **Set up SCIM**. ## Send a setup link to your IT administrator The person who configures your IdP does not need a Living Security account. Send them a setup link. 1. On the SCIM card, in the **Setup link** row, select **Create setup link**. 2. Copy the link from the **Copy the setup link** dialog, then select **I've copied the link**. You can't see the link again. 3. Send the link to your IT administrator over a channel you trust. The link opens a **Set up SCIM for** page for your organization only. It shows the SCIM base URL, a setup checklist with steps for Microsoft Entra ID and Okta, and a button to create a SCIM token. * The link works for 7 days. The card shows the date. * Your organization has one setup link at a time. **Create new link** replaces the old one. * Select **Revoke link** to end it early. * If a token already exists, the link can only start a rotation. The current token keeps working until an administrator selects **Finish rotation** on the SCIM card. * The link can do nothing else. It cannot read people, change settings or finish a rotation. * Every link created, revoked and used is recorded in the audit log. ## Authentication methods The SCIM card creates bearer tokens. Living Security SCIM also accepts HTTP Basic authentication and OAuth 2.0 client credentials for IdPs that cannot send a bearer token. These methods are not on the SCIM card. If your IdP cannot send a bearer token, contact Living Security support. See [API reference: Authentication](https://docs.livingsecurity.com/features/settings/scim/api-reference.md#authentication). ## Check the connection Select **Troubleshoot SCIM** on the SCIM card. The page has four tabs: | Tab | What it shows | | - | - | | **Checklist** | Each setup step and its state: token created, connection test passed, first user received, first user ready to sign in, first sign-in by a SCIM user, first group received, and SSO login names match. | | **Health** | Warnings about the connection, such as **Token expires soon**, **Failed requests**, **Held accounts**, **Changes paused**, **Duplicate group names** or **SSO login name mismatch**. **No warnings** means the connection is healthy. | | **Attributes** | The attribute report: **What to fix**, the **Attributes received** table with how many people have a value for each attribute, and a sample of the newest user. | | **Validate** | **Test a payload** runs a SCIM request as a dry run and shows what would change. **Check an Entra mapping** reads an Entra schema export and finds mapping problems. Nothing is saved. | The SCIM card also shows the **Mode**, the **Last request** and the count of **Held accounts**. Held accounts are explained in [Held changes](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md#held-changes). **Copy diagnostics** on the troubleshooting page copies connection IDs, request IDs and error codes for a support request. It never includes names, email addresses or tokens. ## Related * [Living Security SCIM overview](https://docs.livingsecurity.com/features/settings/scim/overview.md) * [Security and best practices](https://docs.livingsecurity.com/features/settings/scim/security.md) * [Test your SCIM setup](https://docs.livingsecurity.com/features/settings/scim/testing.md) * [SCIM error reference](https://docs.livingsecurity.com/features/settings/scim/errors.md) * [Receive SCIM events](https://docs.livingsecurity.com/features/settings/scim-events.md) ## Related topics - [Set up SCIM with JumpCloud](https://docs.livingsecurity.com/features/settings/scim-jumpcloud.md) - [Set up SCIM with SailPoint](https://docs.livingsecurity.com/features/settings/scim-sailpoint.md) - [Set up SCIM with PingOne or PingFederate](https://docs.livingsecurity.com/features/settings/scim-ping.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.