> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM groups and cohorts

> How groups your identity provider sends through Living Security SCIM become directory groups, and how to use them in cohorts.

> [!NOTE]
>
> **Which SCIM setup applies to you?** These pages describe **Living Security SCIM**. Open the SCIM card in your settings. If the card shows **Set up SCIM**, or its **Mode** row says **Native SCIM**, these pages apply. If **Mode** says **Current SCIM**, your organization still uses the earlier SCIM setup. An admin can move it: see [Move from the earlier SCIM setup](https://docs.livingsecurity.com/features/settings/scim/connection.md#move-from-the-earlier-scim-setup). If the card says SCIM is set up and managed in the setup wizard, use [SCIM Provisioning](https://docs.livingsecurity.com/features/settings/scim.md).

Your identity provider (IdP) can send groups as well as people. Living Security keeps each group and its members, and shows them as directory groups. Use directory groups to build cohorts that follow your directory.

## How groups arrive

* Your IdP creates, updates and deletes groups through `/Groups`. Microsoft Entra ID sends the groups assigned to the app. Okta sends the groups you push with **Push Groups**. See [Set up Microsoft Entra ID](https://docs.livingsecurity.com/features/settings/scim-microsoft-entra-id.md) and [Set up Okta](https://docs.livingsecurity.com/features/settings/scim-okta.md).
* Each member is a SCIM user `id`, or the `id` of another group. A member `id` that is not a user or group in your organization is refused with `400`.
* A group can have up to 10,000 member changes in one request. A `PATCH` that replaces `members` with an empty list empties the group.
* Group names do not have to be unique. When two groups have the same `displayName`, both are kept and **Troubleshoot SCIM → Health** shows **Duplicate group names**. Set your IdP to match groups on `externalId`, and give each group its own `externalId`.

## Directory groups

Changes reach the **Directory groups** tab of **Settings → Sign-in & SSO** after the next directory-group sync. Each group shows its members and which of them are matched to a person in Living Security. A member whose person is not created yet is matched on a later sync, after the person exists.

The **Directory groups** tab, group pages, **Sync now** and the review of large changes work the same as for the earlier SCIM setup. See [Directory groups](https://docs.livingsecurity.com/features/settings/scim.md#directory-groups).

## Use groups in cohorts

In the cohort rule builder, target groups with **is in any of**, **is in all of** or **is not in any of**, or create a cohort from a group. The cohort follows the group: when your IdP adds or removes a member, the cohort changes after the next sync.

* **Nested groups are not expanded.** Living Security stores a group that is a member of another group, but a cohort that targets the outer group includes only its direct people members. Target the inner group as well.
* **Groups never create people.** A person is created only when your IdP provisions them as a user.

## Delete a group

When your IdP deletes a group, Living Security removes its members and removes it from any group that contains it. In **Directory groups**, the group keeps its name and matches nobody, and cohorts that use it show a warning.

## Organizations that move from the earlier SCIM setup

When Living Security moves your organization to Living Security SCIM, your directory groups keep their IDs. Cohorts that use them keep working, and you do not rebuild them.

## Related

* [SCIM user lifecycle](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md)
* [API reference: PATCH](https://docs.livingsecurity.com/features/settings/scim/api-reference.md#patch)


## Related topics

- [Living Security SCIM](https://docs.livingsecurity.com/features/settings/scim/overview.md)
- [SCIM user lifecycle](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md)
- [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.