Integration · SCIM
SCIM integration: create and disable users automatically from your identity provider
Access rights belong in your identity directory, not in manual lists. Via SCIM 2.0, your identity provider (such as Entra ID or Okta) creates users in SimpleAct, updates them and deactivates them when they leave. Users are synchronised, groups are not.
Available in the product (Enterprise)
SimpleAct provides a SCIM 2.0 endpoint for users. Your identity provider reports joiners and leavers; people who leave lose access without anyone maintaining a list.
- Create, update, deactivate and delete users via SCIM 2.0
- New users start with the Viewer role
- No group sync. You assign roles in SimpleAct
What the integration does
User lifecycle from the directory
The integration covers the SCIM resource type User. There are no group endpoints; roles and system assignments remain a deliberate decision in SimpleAct.
- Automatic creation
- When a person is assigned to the SimpleAct application in the identity provider, an account with the Viewer role is created. An administrator grants higher rights in SimpleAct.
- Roles stay in SimpleAct
- Directory groups are not transferred and not mapped to roles. That is deliberate: who is an admin or editor is decided by someone in SimpleAct, not by a group membership.
- Automatic deprovisioning
- When the identity provider sets an account to inactive or deletes it, the person loses access to SimpleAct. The value "False" as sent by Entra ID is also correctly read as a deactivation.
How it works
Setting up SCIM
A one-time setup in the identity provider, after which provisioning runs in the background.
Create a token
An administrator creates an API key with the provisioning permission in SimpleAct. It serves as the bearer token for the SCIM endpoint.
Connect the identity provider
In the identity provider, enter your organisation’s SCIM base URL (/api/v1/scim/v2) and the token, and assign the users.
Assign roles in SimpleAct
New users appear as Viewers. You manage roles and assignments to AI systems or locations in SimpleAct.
What the SCIM integration does and does not do
Built for the user lifecycle, not for managing rights through groups.
- Create, query, update (PUT and PATCH), deactivate and delete users
- Discovery endpoints: ServiceProviderConfig, Schemas, ResourceTypes
- New users with the Viewer role
- No group endpoints and no mapping of groups to roles
- Changing an admin account’s e-mail only through a signed-in session
- Enterprise feature, set up per organisation
Frequently asked questions about SCIM
Which identity providers are supported?
Any identity provider that speaks SCIM 2.0 for users, such as Microsoft Entra ID or Okta.
Can we control roles through groups?
No. SCIM only transfers users. You assign roles in SimpleAct; new users start as Viewers.
What happens when someone leaves the company?
As soon as the identity provider deactivates or deletes the account, the person can no longer sign in to SimpleAct.
User accounts that keep themselves current
With SCIM, the user accounts in SimpleAct stay in line with your directory. Rights remain a deliberate decision.