Skip to main content

SCIM 2.0 Provisioning

SCIM (System for Cross-domain Identity Management) enables automated user provisioning and deprovisioning from your identity provider to AxonFlow.

What is SCIM?​

SCIM 2.0 is an open standard (RFC 7643/7644) for automating the exchange of user identity information between identity providers and service providers. When a user is added, modified, or removed in your IdP, those changes automatically sync to AxonFlow.

Identity Provider (Okta, Azure AD, OneLogin)
         |
         | SCIM 2.0 API Calls
         | (Create, Update, Delete)
         v
+-------------------+
|  AxonFlow SCIM    |
|  Endpoint         |
|  /scim/v2/*       |
+-------------------+
         |
         v
+-------------------+
|  User Accounts    |
|  & Role Sync      |
+-------------------+

Benefits​

Automated User Lifecycle​

Action in IdPResult in AxonFlow
Assign user to appUser created with access
Update user attributesUser profile updated
Unassign user from appUser deactivated
Delete userUser removed

Security & Compliance​

  • Zero manual provisioning - No shared credentials or manual account creation
  • Instant deprovisioning - Users lose access immediately when terminated
  • Audit trail - All SCIM operations are logged for compliance
  • Single source of truth - IdP remains authoritative for user identity

Supported Identity Providers​

AxonFlow's SCIM 2.0 implementation is compatible with:

  • Okta
  • Azure Active Directory (Entra ID)
  • OneLogin
  • Ping Identity
  • JumpCloud
  • Any SCIM 2.0 compliant identity provider

Enterprise Feature​

CapabilityCommunityEnterprise
SCIM 2.0 User Provisioning✅
SCIM 2.0 User Deprovisioning✅
SCIM Group Sync✅
Group-to-Role Mapping✅
Token Management UI✅
SCIM Audit Logging✅
Enterprise Feature

SCIM provisioning is available exclusively with AxonFlow Enterprise. Contact sales to enable automated user provisioning for your organization.

Group-to-Role Mapping​

SCIM group synchronization maps your IdP groups to AxonFlow roles. When a user is assigned to a group in your IdP, they automatically receive the corresponding AxonFlow role.

IdP GroupAxonFlow RolePermissions
axonflow-adminsadminFull platform access, policy management
axonflow-analystsanalystRead-only access, audit log queries
axonflow-developersdeveloperAPI access, SDK usage, limited policy view
axonflow-auditorsauditorAudit log access, compliance reports

Example: Okta Group Push Configuration

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "displayName": "axonflow-admins",
  "members": [
    {"value": "user-001", "display": "Jane Smith"},
    {"value": "user-002", "display": "John Doe"}
  ]
}

When this group is pushed via SCIM, both users receive the admin role in AxonFlow. Removing a user from the group in Okta automatically removes the role.

Sync Troubleshooting​

Common SCIM synchronization issues and their resolutions:

IssueSymptomResolution
401 UnauthorizedSCIM sync fails with authentication errorVerify the SCIM bearer token in your IdP matches the token generated in AxonFlow. Regenerate if expired.
User not createdUser assigned in IdP but not visible in AxonFlowCheck that the SCIM application in your IdP includes the required attributes: userName, emails, displayName.
Group sync delayedGroup membership changes take time to reflectMost IdPs sync on a schedule (e.g., every 40 minutes for Okta). Use "Push Now" in your IdP to force immediate sync.
Duplicate usersSame user appears twice in AxonFlowEnsure userName is unique across your IdP. Check for conflicting SCIM and JIT provisioning.
Deprovisioning not workingRemoved users still have accessVerify your IdP is sending a SCIM PATCH with active: false or a DELETE request. Check AxonFlow SCIM audit logs for incoming requests.

Verify SCIM connectivity:

# Test SCIM endpoint
curl -X GET https://your-axonflow.example.com/scim/v2/Users \
  -H "Authorization: Bearer YOUR_SCIM_TOKEN" \
  -H "Content-Type: application/scim+json"

Learn More​

Enterprise customers can access detailed SCIM documentation including:

  • Step-by-step setup guides for Okta, Azure AD, and OneLogin
  • Complete API endpoint reference
  • Group-to-role mapping configuration
  • Troubleshooting guides

Access the Enterprise Documentation Portal for full implementation details.