SCIM (System for Cross-domain Identity Management) lets your identity provider create, update and remove SmartSuite members and Teams for you. You connect it with a Tenant URL and a Provisioning Authorization Token, on the Enterprise and Signature plans.

SCIM works alongside SAML or OpenID Connect single sign-on. Okta, Microsoft Entra ID and PingFederate are covered below.

Example: a compliance team on Enterprise connects Okta. When a control owner leaves the company, Okta turns off her SmartSuite access the same day, which is the evidence the auditor asks for in the access review.

Plan Availability	Enterprise, Signature.
Permissions	Administrators.
Platform	Web
Related Reading	Configuring Single Sign-On (SSO) Assigning SmartSuite Member Roles via SCIM Enterprise Security and DLP Controls in SmartSuite Invite and manage members.

What SCIM does

Provisioning: creates member accounts in SmartSuite from your IdP.
Lifecycle: turns off or removes members when they leave.
Teams: adds members to SmartSuite Teams from IdP groups.
Roles: assigns SmartSuite roles from your IdP.
Profiles: keeps member details and Team memberships in step.
Logs: shows SCIM activity for troubleshooting.

Step 1: plan the rollout

Decide which users and groups are in scope.
Decide which IdP groups become SmartSuite Teams.
Test with a small group before the whole organization.

Step 2: copy the Provisioning Authorization Token

Sign in to your SmartSuite workspace as an Administrator.
Go to Workspace Administration > SSO Configuration.
Copy the Provisioning Authorization Token.

Note: Treat the token like a password. Anyone with it can manage your members through SCIM.

Step 3: choose who is in scope

Assignment-based scoping: assign users or groups to the SmartSuite app by hand.
Attribute-based scoping: provision users by attributes, such as department or role.

Start with manual assignment for testing, then move to attributes.

Step 4: connect your IdP

Turn on SCIM provisioning in your IdP.
Enter the Tenant URL: https://app.smartsuite.com/authentication/scim
Enter your Provisioning Authorization Token as the secret token.
Test the connection.

Step 5: map the attributes

SmartSuite field.	SCIM attribute.	Required.
id.	externalId.	No.
email.	userName.	Yes.
email.	emails[type eq "work"].value.	No.
full_name.first_name.	name.givenName.	No.
full_name.last_name.	name.familyName.	No.
full_name.title.	honorificPrefix.	No.
status.	active (boolean).	No.

Enterprise user schema extensions:

SmartSuite field.	SCIM attribute.	Required.
company_name.	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization.	No.
department.	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department.	No.
manager_id.	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager.	No.

Roles use the roles attribute with three values: admin, solution_manager and general. See Assigning SmartSuite Member Roles via SCIM.

Step 6: turn provisioning on

In your IdP, set Provisioning Status to On.
Set the users and groups in scope.
Save to start the sync.

The first sync takes longer. Later cycles usually run every 30 to 60 minutes, depending on your IdP.

Okta

Go to Applications > Add Application > SCIM Provisioning.
Map the SmartSuite attributes above.
Turn on lifecycle operations to activate and deactivate users.
Add enterprise schema attributes as needed.

Microsoft Entra ID

In Enterprise Applications, enter the SCIM URL and token.
Add mappings for fields such as department or organization. Enter each target attribute exactly as in the tables, such as name.givenName, not givenName.
Map the active attribute to turn members on and off.
Set group assignments if you provision Teams.

Warning: If a target attribute does not match exactly, Entra rejects the mapping and provisions no one. The error reads SystemForCrossDomainIdentityManagementServiceIncompatible, often with Unsupported patch operation.

PingFederate

Go to Provisioning > Connections and turn on SCIM.
Map the source fields to the SmartSuite SCIM attributes.
Set a sync frequency.
Test with sample users.

SCIM API endpoints

SmartSuite provides SCIM 2.0 endpoints for direct integration or testing with a tool such as Postman.

Users: GET, POST to /authentication/scim/Users; GET, PUT, PATCH and DELETE to /authentication/scim/Users/{userId}.
Groups: GET, POST to /authentication/scim/Groups; GET, PUT, PATCH and DELETE to /authentication/scim/Groups/{groupId}.

You cannot delete the last Administrator in a workspace.

A user creation request with a role, shortened:

POST /authentication/scim/Users {"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "userName": "user@example.com", "roles": ["general"]}

Tip: Write down your attribute mappings when you finish. The next person to change the IdP setup will need them.

Frequently asked questions

Which plans include SCIM?

SCIM provisioning and SCIM-synced groups are on the Enterprise and Signature plans.

How often does SCIM sync?

After the first sync, cycles usually run every 30 to 60 minutes. Your IdP sets the timing.

Why did Entra provision no users?

A target attribute does not match exactly. Enter each one as the tables show, such as name.givenName rather than givenName.

Can SCIM delete the last Administrator?

No. SmartSuite refuses to delete the last Administrator in a workspace.

Which roles can SCIM assign?

SCIM can assign admin, solution_manager and general through the roles attribute.

Need more help? Ask the SmartSuite Community, where builders, administrators and the SmartSuite team answer questions about building on SmartSuite. For your account, billing or data, select the chat button in the lower-right corner of SmartSuite to reach support.

Last verified 1 Nov 2026.

Configuring SCIM