Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
Living Security SCIM connects your identity provider (IdP), such as Microsoft Entra ID or Okta, to the Living Security Platform. Your IdP creates, updates, deactivates and deletes people and groups through the SCIM 2.0 standard (RFC 7643 and RFC 7644). You do not import or edit those people by hand.

What SCIM does

  • Creates people. When you assign a person to the Living Security app in your IdP, the person appears in Workforce → People.
  • Keeps profiles current. Name, title, department, manager and the other mapped attributes follow your directory.
  • Removes access. When your IdP deactivates or deletes a person, their access ends at once.
  • Sends groups. Groups your IdP pushes become directory groups that you can use in cohorts. See Groups and cohorts.

SCIM, SSO and just-in-time sign-in

SCIM and SSO are separate. You can use SCIM without SSO: people then sign in with their email address. When you use both, the person’s SCIM userName and the NameID your SSO sends must be the same value, the person’s email address. See SSO, multiple connections and sub-organizations.

How a change flows

  1. Your IdP sends a SCIM request to your organization’s regional base URL with its token.
  2. Living Security checks the token, the request and the limits, saves the change, and answers your IdP at once.
  3. Living Security applies the change to the person in Workforce → People and to their sign-in account, usually within a minute. When your IdP sends many changes at once, this can take a few minutes. A deactivation or delete applies to the person in the same request, so their Living Security access ends at once.
  4. If a policy stops a change, for example because it would remove your last owner, the IdP still gets a success response. The change is held and shows on the SCIM card. See Held changes.

Regional base URLs

Each organization has one data residency region, chosen when the organization is created. The SCIM base URL belongs to that region: Copy the base URL from the SCIM card. A token sent to another region’s URL is refused with 401. The response does not say which region is correct.

What is stored where

Living Security never stores a password your IdP sends. It discards the value. SCIM roles and entitlements are stored but never grant access in Living Security.

Organizations that already use SCIM

When you set up SCIM in an organization that has no SCIM connection, it uses Living Security SCIM. An organization that already provisions people through the earlier SCIM setup can move itself: an admin selects Set up SCIM on the SCIM card. Living Security first copies your current SCIM users and groups, and keeps the user and group IDs your IdP has stored, so you do not assign people again. People keep their accounts and sign in the same way. The earlier connection turns off automatically at the first change your IdP sends with the new token. See Move from the earlier SCIM setup.

Next steps