Intermediate12 min

SCIM

The provisioning protocol: create, update, and deprovision accounts across systems automatically.

By the end of this lesson, explain what SCIM automates and why deprovisioning is a security control.

How deep?

How the pieces actually move.

SSO handles login, but accounts still have to exist in each app, and stale accounts have to be removed. SCIM (System for Cross-domain Identity Management) is the REST/JSON standard that lets an identity provider push user and group lifecycle — create, update, deactivate — into downstream applications automatically.

First, the whole system

First, see the whole system. Then we’ll open it up.

Lifecycle sync

The identity provider (backed by HR as source of truth) pushes SCIM create/update/delete operations to each connected app to keep accounts in sync.

flowchart LR
  hr[HR / IdP source of truth] -->|SCIM create/update/delete| app1[App A]
  hr -->|SCIM| app2[App B]
  hr -->|SCIM| app3[App C]

Why it exists

You know what happens. Now see why it works.

The dangerous gap in identity is offboarding. When someone leaves, every app they touched must lose access — fast. Manual deprovisioning is slow and error-prone, leaving valid credentials for former employees. SCIM makes deactivation immediate and consistent, which is why it's an audit and compliance staple.

Abstraction leak

This is where the abstraction starts leaking.

SSO without SCIM feels done but isn't: disabling someone in the IdP stops new SSO logins, but any app with a local password, API key, or long-lived token the user set up stays open. Provisioning and deprovisioning are the other half of identity.

Deprovisioning gap

Trigger: A user leaves but retains access in apps not covered by SCIM (or with local credentials).
Symptom: Former employees or contractors keep working access.
Blast radius: Data exfiltration and standing access with no owner or monitoring.
Mitigation: SCIM-connect all apps; inventory local credentials; alert on post-offboarding access.

Deep dive: Stale Authorization

How it connects

You disabled a departing employee in Okta. Are they fully off?

Not necessarily. SSO logins stop, but apps with local credentials or long-lived tokens outside SCIM may still grant access. Deprovisioning must reach every app.