> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM with SSO and sub-organizations

> How people provisioned by Living Security SCIM sign in, how SCIM works with more than one SSO connection, and how it works in parent and sub-organizations.

> [!NOTE]
>
> **Which SCIM setup applies to you?** These pages describe **Living Security SCIM**. Open the SCIM card in your settings. If the card shows **Set up SCIM**, or its **Mode** row says **Native SCIM**, these pages apply. If **Mode** says **Current SCIM**, your organization still uses the earlier SCIM setup. An admin can move it: see [Move from the earlier SCIM setup](https://docs.livingsecurity.com/features/settings/scim/connection.md#move-from-the-earlier-scim-setup). If the card says SCIM is set up and managed in the setup wizard, use [SCIM Provisioning](https://docs.livingsecurity.com/features/settings/scim.md).

SCIM creates people. SSO signs them in. This page explains how the two fit together, and how SCIM works when your organization has several SSO connections or sub-organizations.

## Identity requirements

Living Security links an SSO sign-in to the person SCIM provisioned by their login name. Configure your identity provider (IdP) so that these three values are the same, the person's email address:

* the SCIM `userName`
* the person's primary SCIM email
* the NameID (subject) your SSO connection sends

If the `userName` and the SSO NameID differ, provisioning succeeds but the person cannot sign in with SSO. The full rules and per-IdP settings are in [SSO identity requirements](https://docs.livingsecurity.com/features/settings/sso.md#identity-requirements).

Two checks help you find a mismatch:

* **Troubleshoot SCIM → Checklist** shows **SSO login names match** when the values agree. **Troubleshoot SCIM → Health** warns **SSO login name mismatch** when they do not.
* **Troubleshoot SCIM → Validate → Check an Entra mapping** compares the source of your Entra `userName` mapping with the NameID source you enter.

## Organizations without SSO

SCIM does not need SSO. In an organization without SSO, people that SCIM creates sign in with their email address.

## Just-in-time sign-in

With SCIM, people exist before their first sign-in, so you do not need just-in-time (JIT) account creation. A person that SCIM has not created, or has deactivated, cannot get access through SSO when JIT is off.

## More than one SSO connection

An organization has one Living Security SCIM connection, even when it has several SSO connections. The SCIM connection is not tied to one SSO connection. Configure every SSO connection to send the person's email address as the NameID, the same value as the SCIM `userName`. See [Additional SSO connections](https://docs.livingsecurity.com/features/settings/sso.md#additional-sso-connections).

## Sub-organizations

Each organization in a parent and sub-organization tree is provisioned separately.

* **A sub-organization that does not use its parent's SSO** has its own Living Security SCIM connection, base URL and token. Set it up from the sub-organization's own SCIM card.
* **A sub-organization that uses its parent's SSO** does not get a Living Security SCIM connection. Its SCIM card offers its own SCIM key instead: **Create SCIM key**, **Replace key** and **Revoke key**. People still sign in with the parent organization's SSO. Replacing the key turns off the old key at once, so provisioning stops until your IdP has the new key.
* **A person in both a parent and a sub-organization** has a separate sign-in account in each. Deleting or deactivating them in the sub-organization leaves their parent organization sign-in working.
* SCIM never changes [parent organization access](https://docs.livingsecurity.com/features/settings/parent-organization-access.md) grants.

## Related

* [Living Security SCIM overview](https://docs.livingsecurity.com/features/settings/scim/overview.md)
* [Authentication and SSO](https://docs.livingsecurity.com/features/settings/sso.md)
* [Sub-organizations](https://docs.livingsecurity.com/features/settings/sub-organizations.md)
* [SCIM user lifecycle](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md)


## Related topics

- [Set up a SCIM connection](https://docs.livingsecurity.com/features/settings/scim/connection.md)
- [SCIM user lifecycle](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md)
- [Set up SCIM with another SCIM 2.0 client](https://docs.livingsecurity.com/features/settings/scim-generic.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.