Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
SCIM creates people. SSO signs them in. This page explains how the two fit together, and how SCIM works when your organization has several SSO connections or sub-organizations.

Identity requirements

Living Security links an SSO sign-in to the person SCIM provisioned by their login name. Configure your identity provider (IdP) so that these three values are the same, the person’s email address:
  • the SCIM userName
  • the person’s primary SCIM email
  • the NameID (subject) your SSO connection sends
If the userName and the SSO NameID differ, provisioning succeeds but the person cannot sign in with SSO. The full rules and per-IdP settings are in SSO identity requirements. Two checks help you find a mismatch:
  • Troubleshoot SCIM → Checklist shows SSO login names match when the values agree. Troubleshoot SCIM → Health warns SSO login name mismatch when they do not.
  • Troubleshoot SCIM → Validate → Check an Entra mapping compares the source of your Entra userName mapping with the NameID source you enter.

Organizations without SSO

SCIM does not need SSO. In an organization without SSO, people that SCIM creates sign in with their email address.

Just-in-time sign-in

With SCIM, people exist before their first sign-in, so you do not need just-in-time (JIT) account creation. A person that SCIM has not created, or has deactivated, cannot get access through SSO when JIT is off.

More than one SSO connection

An organization has one Living Security SCIM connection, even when it has several SSO connections. The SCIM connection is not tied to one SSO connection. Configure every SSO connection to send the person’s email address as the NameID, the same value as the SCIM userName. See Additional SSO connections.

Sub-organizations

Each organization in a parent and sub-organization tree is provisioned separately.
  • A sub-organization that does not use its parent’s SSO has its own Living Security SCIM connection, base URL and token. Set it up from the sub-organization’s own SCIM card.
  • A sub-organization that uses its parent’s SSO does not get a Living Security SCIM connection. Its SCIM card offers its own SCIM key instead: Create SCIM key, Replace key and Revoke key. People still sign in with the parent organization’s SSO. Replacing the key turns off the old key at once, so provisioning stops until your IdP has the new key.
  • A person in both a parent and a sub-organization has a separate sign-in account in each. Deleting or deactivating them in the sub-organization leaves their parent organization sign-in working.
  • SCIM never changes parent organization access grants.