Skip to content

Set up SCIM user provisioning

Configure SCIM provisioning to automatically create, update, and remove users in RShift Sites using your identity provider. Manage user access, roles, and lifecycle centrally with Okta, Microsoft Entra ID, and other SCIM 2.0 providers.

Updated View as Markdown

<head> <script type=“application/ld+json”> {{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Can I use SCIM without SSO?", "acceptedAnswer": {"@type": "Answer", "text": "No, SCIM requires an active SSO provider. Users provisioned via SCIM authenticate using your configured SSO provider."}}, {"@type": "Question", "name": "What happens to existing users when I enable SCIM?", "acceptedAnswer": {"@type": "Answer", "text": "Existing workspace members are not affected when you enable SCIM. SCIM manages users provisioned through your IdP. Previously invited users continue to exist alongside SCIM-provisioned users. Enabling SCIM disables verified email sign-up, so new users with a verified-domain email no longer join automatically outside SCIM."}}, {"@type": "Question", "name": "I lost my API key. What should I do?", "acceptedAnswer": {"@type": "Answer", "text": "You can copy the API key only on the setup screen where RShift Sites generates it. If you've lost it: Go to Settings → Access → Identity and click the SCIM provisioning row. On the General tab, click Rotate API key next to SCIM API key and confirm with Rotate key. Copy the new key, then update your IdP with it."}}, {"@type": "Question", "name": "Can I provision users without sending them a welcome email?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. During SCIM setup, disable Send welcome email to provisioned users. You can also change this setting at any time from the General tab of the SCIM provisioning dialog in Settings → Access → Identity. When disabled, provisioned users can sign in through your configured SSO provider without receiving an invitation email from RShift Sites."}}, {"@type": "Question", "name": "What happens if a user belongs to multiple mapped groups?", "acceptedAnswer": {"@type": "Answer", "text": "When a user belongs to multiple mapped groups, RShift Sites assigns the highest-privilege role from those groups."}}, {"@type": "Question", "name": "Why does my IdP group not match a role mapping?", "acceptedAnswer": {"@type": "Answer", "text": "Group name matching is case-sensitive. The name in your mapping must match the group name your identity provider sends exactly, including capitalization and punctuation. Copy the name from your identity provider instead of typing it. Until the names match, users in that group receive the default role."}}, {"@type": "Question", "name": "Should I use SCIM or just-in-time (JIT) provisioning?", "acceptedAnswer": {"@type": "Answer", "text": "SCIM is recommended for managed environments where user lifecycle and access should be controlled centrally from your identity provider. Just-in-time (JIT) provisioning applies only to users who sign up through SSO. When a user is created via SSO sign-up, the JIT role is applied. When users are provisioned via SCIM, user creation and role assignment are managed by SCIM, including group-based role mappings, user metadata, or the default SCIM role. In this case, SCIM provisioning and role assignments take precedence over JIT."}}]}} </script> </head>

SCIM (System for Cross-domain Identity Management) lets your identity provider (IdP) create, update, and remove RShift Sites users automatically. It is available on the Enterprise plan.

With SCIM, you can manage workspace access centrally from your IdP. Users are automatically added when assigned, removed when unassigned, and assigned roles based on group membership, keeping your workspace in sync without manual user management.

Prerequisites

Before setting up SCIM provisioning, you need:

  • IdP admin access in Okta, Microsoft Entra ID, or any other SCIM 2.0 provider.
  • Workspace owner or admin role in RShift Sites.
  • At least one verified domain for your workspace. SCIM only provisions users whose email domain is verified. See Verify a domain for your workspace.
  • An active single sign-on (SSO) provider using OIDC or SAML. See Set up single sign-on (SSO).
  • IdP groups for each RShift Sites role. During setup, you map at least one IdP group to each of the Admin, Editor, and Viewer roles. See Plan your identity provider groups.

If you don’t have SSO yet, you typically create one application in your identity provider that handles both SSO authentication and SCIM provisioning. If you already have SSO, you can create a separate IdP application for SCIM provisioning and keep your existing SSO setup unchanged. RShift Sites continues to use your current SSO provider for authentication, regardless of which IdP application handles SCIM.

How SCIM works in RShift Sites

This section explains how RShift Sites processes SCIM events from your identity provider.

User provisioning

When your IdP creates or assigns a user to the RShift Sites application:

  1. The IdP sends a SCIM request to RShift Sites.
  2. RShift Sites verifies that the user’s email domain is verified for your workspace.
  3. If Send welcome email to provisioned users is enabled, the user receives an email invitation to join.
  4. The user joins the workspace with the default role when they accept the invitation or sign in through your SSO provider. When your IdP pushes their group membership, RShift Sites updates the role from your group mappings.

User deprovisioning

When your IdP removes or deactivates a user:

  1. The IdP sends a deactivation request to RShift Sites.
  2. RShift Sites removes the user from your workspace, or deletes their pending invitation if they have not joined yet.
  3. The user can no longer access the workspace. Projects they owned go to the member with the highest role (owners first, then admins, then editors). Projects with access set to Restricted are not transferred. A workspace owner has to transfer them manually. See Choose who inherits their projects.

Group push and role updates

When your IdP pushes groups to RShift Sites:

  1. Pushed groups appear in Settings → Access → Groups with a SCIM badge, and RShift Sites keeps their membership in sync with your IdP. See SCIM groups.
  2. Users in a mapped group receive the mapped role. A user in several mapped groups receives the highest-privilege role.
  3. Users removed from all mapped groups keep their workspace access and receive the default role. To remove a user from the workspace, unassign them from the RShift Sites application in your IdP.

Supported SCIM operations

RShift Sites implements the SCIM 2.0 specification and supports the following operations:

Resource Supported operations
Users Create, read, update, delete, list
Groups Create, read, update, delete, list, member push

Plan your identity provider groups

RShift Sites assigns roles from the IdP groups you map, so decide on your groups before you start the setup wizard. You create and manage the groups in your identity provider. These rules are specific to RShift Sites:

  • One group per role, at minimum. The setup wizard requires at least one group mapped to each of Admin, Editor, and Viewer. You can map more groups to the same role later, for example one group per team that all map to Editor.
  • Exact names. Enter each group name exactly as your identity provider sends it, including capitalization and punctuation. Matching is case-sensitive, so Engineering-Admins and engineering-admins are different groups to RShift Sites.
  • Highest role wins. A user in several mapped groups receives the highest-privilege role among them.
  • A default role covers everyone else. Users whose groups have no mapping receive the default role, which is Viewer after setup. You can change the default role later.
  • Push the groups you map. If your identity provider supports group push, push the same groups you map in RShift Sites so that group membership stays in sync.
  • Owner is a mapping option. A group mapped to Owner grants the Owner role to its members, and the current owner’s role follows their groups like anyone else’s. See Group push and role updates.

For creating groups, adding members, and pushing or assigning groups to an application, follow your identity provider’s documentation:

Set up SCIM provisioning

Setting up SCIM provisioning requires configuration in both RShift Sites and your identity provider. You start in RShift Sites, where a short wizard collects your group mappings and then generates the credentials your identity provider needs. You then complete the setup in your IdP.

Step 1: Configure SCIM in RShift Sites

First, enable SCIM provisioning in RShift Sites and copy the values needed by your identity provider.

Open identity settings and start the setup

Go to Identity (Settings → Access → Identity) and click Enable in the SCIM provisioning row.

The button is disabled until your workspace has an SSO provider, with the hint Configure an SSO provider before enabling SCIM.

Configure group mappings and the welcome email

The wizard opens on Configure group mappings with one row each for Admin, Editor, and Viewer.

  • Group name: Enter the group name exactly as it appears in your identity provider. Matching is case-sensitive.
  • Role: Choose Viewer, Editor, Admin, or Owner.

Click Add group to map more groups. Each of Admin, Editor, and Viewer needs at least one group. RShift Sites locks the last row for those roles, and Continue stays disabled until all three have a group name.

Below the table, use the Send welcome email to provisioned users toggle to control whether RShift Sites emails an invitation to each user provisioned through SCIM.

  • Enabled (default): Each newly provisioned user receives a welcome email with a link to join the workspace.
  • Disabled: Users are provisioned silently. They can still sign in through your configured SSO provider when they’re assigned in your IdP.

Click Continue. RShift Sites enables SCIM provisioning and generates your API key.

Copy the Base SCIM URL and API key

The Set up SCIM provisioning screen shows the two values your identity provider needs:

  • Base SCIM URL: The endpoint your IdP uses to sync users.
  • SCIM API key: The bearer token that authenticates SCIM requests. Anyone with this key can provision users in your workspace.

Click Done to finish. If you click Cancel on this screen and confirm with Cancel setup, RShift Sites disables SCIM and invalidates the new API key. Run the setup again to generate another one.

After setup, the default role for users without a mapped group is Viewer. You can change it, add more group mappings, or update the welcome email setting at any time. See Manage SCIM provisioning.

Step 2: Configure SCIM in your identity provider

Use the values generated in RShift Sites to configure SCIM provisioning in your identity provider.

Setting Value
Base URL https://api.lovable.dev/scim/v2
Authentication Bearer token
API key &lt;your API key generated in RShift Sites>

Select your identity provider below and follow the instructions to complete SCIM configuration. For more information, refer to your IdP’s official documentation.

Okta

SCIM provisioning uses the same RShift Sites app you added from the Okta App Catalog for SSO. Complete Set up single sign-on (SSO) first.

Open the RShift Sites app’s Provisioning tab

In the Okta Admin Console, open the RShift Sites application you created for SSO and go to the Provisioning tab.

Configure API integration

  • Click Configure API Integration, then check Enable API integration.
    • Enter the Base URL (https://api.lovable.dev/scim/v2) and paste your RShift Sites SCIM API key into the API Token field.
    • Click Test API Credentials. You should see “RShift Sites was verified successfully!”
    • Click Save.

Enable provisioning actions

  • In the Provisioning tab, click To App in the left sidebar.
    • Click Edit and enable:
      • Create Users
      • Update User Attributes
      • Deactivate Users
    • Click Save.

Assign users and push groups

  • Assign users (or groups) to the RShift Sites app under Assignments.
    • Enable group push in Okta and push the same groups you mapped in RShift Sites, using the same group names.

Microsoft Entra ID (Azure AD)

SCIM provisioning in Microsoft Entra ID is supported only through a SAML application. If you use OIDC for SSO, you’ll need to create a separate SAML app in Microsoft Entra ID for SCIM provisioning.

Start provisioning setup in Microsoft Entra ID

  • Go to Microsoft Entra admin center → Enterprise applications.
    • Create a new SAML application or select your existing SAML RShift Sites app.
    • Select Provisioning → New configuration.

Configure admin credentials

Under Admin credentials, enter the following values:

  • Authentication method: Bearer Authentication
  • Tenant URL: https://api.lovable.dev/scim/v2
  • Secret token: <your RShift Sites SCIM API key>

Test the connection

Click Test connection to verify the setup.

Create the configuration

Click Create.

Start provisioning

In the provisioning configuration Overview (Preview) page, click Start provisioning.

Other SCIM 2.0 providers

If you’re using any other identity provider that supports SCIM 2.0, follow these general instructions to configure provisioning.

Enable SCIM provisioning or automatic provisioning in your IdP

  • In your IdP admin console, locate the SCIM or provisioning settings for your RShift Sites application.
    • Enable SCIM provisioning or automatic provisioning.

Configure the SCIM connection

Configure the SCIM connection with the following values:

  • SCIM base URL / Tenant URL: https://api.lovable.dev/scim/v2
  • Authentication method: Bearer token (HTTP header)
  • API token / Secret token: <your RShift Sites SCIM API key>
  • Unique identifier field: userName (email address)

Enable provisioning actions

Enable the provisioning actions you want to use:

  • Create users
  • Update user attributes
  • Deactivate or delete users
  • Push groups (if using group-based role mapping)

Test the connection

Test the connection using your IdP’s built-in test feature.

Save the configuration

Save the configuration and enable provisioning.

When SCIM provisioning is configured in both RShift Sites and your identity provider, user provisioning and deprovisioning will begin automatically based on assignments in your IdP.

Manage SCIM provisioning

After setup, the SCIM provisioning row in Identity (Settings → Access → Identity) shows the Base SCIM URL and the current default role. Click the row to open the SCIM provisioning dialog, which has three tabs:

  • General: the Base SCIM URL, the API key, the default role, the welcome email setting, the SCIM-managed membership setting, and the Disable SCIM button.
  • Groups: your group role mappings.
  • Activity: a log of the SCIM requests your identity provider has sent.

Changes on the General tab apply when you click Save changes.

Manage group role mappings

Group role mappings assign a workspace role to every user in a matching IdP group, so you can control permissions centrally. The mappings you entered during setup appear on the Groups tab of the SCIM provisioning dialog.

To add a group role mapping:

  1. Go to Identity (Settings → Access → Identity) and click the SCIM provisioning row.
  2. Open the Groups tab.
  3. In the empty row, enter the Group name exactly as it appears in your IdP (for example, engineering-admins).
  4. Select the Role to assign: Viewer, Editor, Admin, or Owner.
  5. Click Add.

Changes on the Groups tab apply immediately. To change a mapping’s role, select a new role in its Role column. To remove a mapping, click its trash icon and confirm with Delete. Users in that group are no longer assigned the mapped role. Each of Admin, Editor, and Viewer must keep at least one mapping, so RShift Sites locks the role and the trash icon on the last mapping for those roles.

Group names must match your identity provider exactly, including capitalization. See Plan your identity provider groups.

Example mappings

IdP group RShift Sites role
lovable-admins Admin
engineering Editor
contractors Viewer

Change the default role

The default role applies to provisioned users who are in no mapped group. It is Viewer after setup. Changing it affects future provisioning and group syncs, not the roles members already have.

  1. Go to Identity (Settings → Access → Identity) and click the SCIM provisioning row.
  2. On the General tab, choose Viewer, Editor, or Admin under Default role for new members.
  3. Click Save changes.

Rotate the API key

Rotate the API key if it may have been exposed or you need a new one:

  1. Go to Identity (Settings → Access → Identity) and click the SCIM provisioning row.
  2. On the General tab, click Rotate API key (the rotate icon) next to SCIM API key.
  3. Click Rotate key to confirm.
  4. Copy the new API key from the New SCIM API key dialog, then click Done.
  5. Update your IdP with the new API key.

Toggle welcome emails for provisioned users

Control whether RShift Sites sends a welcome email to each user provisioned through SCIM:

  1. Go to Identity (Settings → Access → Identity) and click the SCIM provisioning row.
  2. On the General tab, enable or disable Send welcome email to provisioned users.
  3. Click Save changes. The change applies to users provisioned after you save. Existing members are not affected.

Lock membership to your identity provider

Enable SCIM-managed invites and removal to make your identity provider the only source of workspace membership. While it is enabled, RShift Sites blocks these actions for everyone in the workspace, including admins and owners:

  • Inviting members, including through workspace invite links
  • Removing members who have joined
  • Project collaborator invitations that would add someone to the workspace
  • Approving workspace access requests
  • Transferring primary ownership to an account outside the workspace (transfers to existing members still work)

Admins and owners can still revoke pending invitations and change member roles in RShift Sites. SSO sign-in still adds users your IdP has provisioned.

  1. Go to Identity (Settings → Access → Identity) and click the SCIM provisioning row.
  2. On the General tab, enable SCIM-managed invites and removal.
  3. Click Save changes.

Disabling SCIM also disables this setting.

Review SCIM activity

The Activity tab of the SCIM provisioning dialog lists the requests your identity provider has sent, with the time, action, affected user or group, and whether the request succeeded. Use it to confirm that a sync reached RShift Sites or to find the request that failed.

  • Last SCIM activity, next to the SCIM activity heading, shows when your IdP last contacted RShift Sites, or No requests received yet if it never has.
  • The Users and Groups cards summarize the requests in the selected period.
  • Search by user or group, or filter by action. The actions are User created, User updated, User deleted, User deactivated, User role updated, User domain blocked, Group created, Group updated, and Group deleted.
  • Click a row to see the full details of the request. View all in audit logs opens the same events in the audit log.

You can also filter the People tab by SCIM-managed or Not SCIM-managed to see which members your identity provider controls.

Disable SCIM provisioning

To stop automatic provisioning:

  1. Go to Identity (Settings → Access → Identity) and click the SCIM provisioning row.
  2. On the General tab, click Disable SCIM.
  3. Click Disable SCIM again to confirm.

Troubleshooting

Domain "example.com" is not verified for this workspace

SCIM only provisions users whose email domain is verified for your workspace. Your IdP receives this message with a 403 status, with the user’s domain in place of example.com, and the request appears as User domain blocked on the Activity tab. To fix:

  1. Go to Identity (Settings → Access → Identity).
  2. Add and verify the email domain under Verified domains.
  3. Retry provisioning from your IdP.

Users are provisioned but can’t log in

Verify that:

  • Your SSO provider is correctly configured.
  • Users are assigned to the SSO application in your IdP.

Users provisioned via SCIM must authenticate through SSO.

Role mappings are not being applied

Check that:

  • Group names in your mappings match what your IdP sends exactly, including capitalization.
  • Your IdP is configured to push groups to RShift Sites.
  • The Activity tab shows the group sync from your IdP as Group created or Group updated.

FAQ

Can I use SCIM without SSO?

No, SCIM requires an active SSO provider. Users provisioned via SCIM authenticate using your configured SSO provider.

What happens to existing users when I enable SCIM?

Existing workspace members are not affected when you enable SCIM. SCIM manages users provisioned through your IdP. Previously invited users continue to exist alongside SCIM-provisioned users.

Enabling SCIM disables Verified email sign-up, so new users with a verified-domain email no longer join automatically outside SCIM. See Workspace identity settings.

I lost my API key. What should I do?

You can copy the API key only on the setup screen where RShift Sites generates it. If you’ve lost it:

  1. Go to Identity (Settings → Access → Identity) and click the SCIM provisioning row.
  2. On the General tab, click Rotate API key next to SCIM API key and confirm with Rotate key.
  3. Copy the new key, then update your IdP with it.

Can I provision users without sending them a welcome email?

Yes. During SCIM setup, disable Send welcome email to provisioned users. You can also change this setting at any time from the General tab of the SCIM provisioning dialog in Identity (Settings → Access → Identity). When disabled, provisioned users can sign in through your configured SSO provider without receiving an invitation email from RShift Sites.

What happens if a user belongs to multiple mapped groups?

When a user belongs to multiple mapped groups, RShift Sites assigns the highest-privilege role from those groups.

Why does my IdP group not match a role mapping?

Group name matching is case-sensitive. The name in your mapping must match the group name your identity provider sends exactly, including capitalization and punctuation. Copy the name from your identity provider instead of typing it. Until the names match, users in that group receive the default role.

Should I use SCIM or just-in-time (JIT) provisioning?

SCIM is recommended for managed environments where user lifecycle and access should be controlled centrally from your identity provider.

Just-in-time (JIT) provisioning applies only to users who sign up through SSO. When a user is created via SSO sign-up, the JIT role is applied.

When users are provisioned via SCIM, user creation and role assignment are managed by SCIM, including group-based role mappings, user metadata, or the default SCIM role. In this case, SCIM provisioning and role assignments take precedence over JIT.

Navigation

Search for a question, a feature, or a task.

↑↓ to navigate↵ to openEsc to close