Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
Your identity provider (IdP) can send groups as well as people. Living Security keeps each group and its members, and shows them as directory groups. Use directory groups to build cohorts that follow your directory.

How groups arrive

  • Your IdP creates, updates and deletes groups through /Groups. Microsoft Entra ID sends the groups assigned to the app. Okta sends the groups you push with Push Groups. See Set up Microsoft Entra ID and Set up Okta.
  • Each member is a SCIM user id, or the id of another group. A member id that is not a user or group in your organization is refused with 400.
  • A group can have up to 10,000 member changes in one request. A PATCH that replaces members with an empty list empties the group.
  • Group names do not have to be unique. When two groups have the same displayName, both are kept and Troubleshoot SCIM → Health shows Duplicate group names. Set your IdP to match groups on externalId, and give each group its own externalId.

Directory groups

Changes reach the Directory groups tab of Settings → Sign-in & SSO after the next directory-group sync. Each group shows its members and which of them are matched to a person in Living Security. A member whose person is not created yet is matched on a later sync, after the person exists. The Directory groups tab, group pages, Sync now and the review of large changes work the same as for the earlier SCIM setup. See Directory groups.

Use groups in cohorts

In the cohort rule builder, target groups with is in any of, is in all of or is not in any of, or create a cohort from a group. The cohort follows the group: when your IdP adds or removes a member, the cohort changes after the next sync.
  • Nested groups are not expanded. Living Security stores a group that is a member of another group, but a cohort that targets the outer group includes only its direct people members. Target the inner group as well.
  • Groups never create people. A person is created only when your IdP provisions them as a user.

Delete a group

When your IdP deletes a group, Living Security removes its members and removes it from any group that contains it. In Directory groups, the group keeps its name and matches nobody, and cohorts that use it show a warning.

Organizations that move from the earlier SCIM setup

When Living Security moves your organization to Living Security SCIM, your directory groups keep their IDs. Cohorts that use them keep working, and you do not rebuild them.