What is SCIM?

SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning: creating, updating and deactivating user accounts and their access across many applications from one place.

Your IT team manages users and groups in an Identity Provider (IdP), such as Microsoft Entra ID or Okta. The IdP sends those users and groups to the Service Provider (SP), here the Arcules Web Platform, so you don't have to maintain accounts in two places. When changes to a user account happen in the IDP, these changes are automatically synchronized with the Arcules Web Platform through the SCIM protocol.

Note: The SCIM protocol allows you to leverage your existing users and groups already present in your IDP and synchronize them with the Arcules Web Platform.

Supported identity providers

Identity provider	Setup guide
Microsoft Entra ID	SCIM Integration with Microsoft Entra ID
Okta	SCIM Integration with Okta
Any other IdP that supports SCIM 2.0	Other SCIM 2.0 identity providers (below)

For single sign-on (SAML 2.0), see Setting up SSO for your organization.

Enabling SCIM in the Arcules Web Portal

Navigate in the Arcules Web Portal (Settings > Identity & Access Management) to the following screen:

Select your IDP from the dropdown menu, then click on the Enable button in the SCIM section:

After clicking on the Enable button you will see the following configuration:

URL: This is the tenant URL and will be used for the SCIM configuration in Entra ID.
Secret Token: The token required for the SCIM configuration in Entra ID. This token is only viewable once, which means that once the page is reloaded, the token will not re-appear. If you fail to copy the token when it is initially shown to you, you will need to regenerate a new token.

Refreshing the SCIM Token

If you want to regenerate the SCIM token, in case it is lost or it has been compromised, you can do this in the Arcules Web Portal.

Note: Once you refresh an organization's SCIM token, the previous token is immediately invalidated. Then, you should use the new token to reconfigure the Identity Provider (IdP) in order to avoid interruptions to your user provisioning.

Requirements

Your organization must already have had SCIM provisioning enabled.
You must have the IT Manager role assigned in order to refresh the SCIM token.

From the Arcules Web Portal, on the left menu, open the Settings > Identity & Access Management menu, then click on the Refresh button in the SCIM section.

You will see the following dialog:

Click Refresh Token to confirm. The newly generated SCIM token displays.

Select the token to copy it to your clipboard. This new token revokes the previous one and cannot be undone.

Email Notifications for Token Expiration

SCIM tokens are valid for one year. Users with the IT Manager role receive email reminders until the token is refreshed:

When	Reminder
Before expiration	60, 30 and 15 days before
Final week	Daily from 7 days before until the day it expires
After expiration	3, 7 and 13 days after

We recommend refreshing the token regularly so user and group sync isn't interrupted.

How provisioned users and groups behave in Arcules

Users and groups provisioned through SCIM are managed by your identity provider. Make changes in your IdP, not in the Arcules Web Portal.
Groups are created without permissions. After a group is provisioned, an IT Manager must sign in to the Arcules Web Portal and assign permissions to it. See How to manage users, groups & permissions.
Each user's email comes from userName. Your IdP must send the user's email address as userName.

What each action in your IdP does in Arcules

Action in your identity provider	Microsoft Entra ID	Okta	Other SCIM 2.0 IdP
Assign a user to the Arcules app	User created	User created	User created (`POST`)
Update a user's profile	User updated	User updated	User updated (`PUT` or `PATCH`)
Unassign or deactivate a user	User deactivated	User deactivated	User deactivated (`active: false`)
Reactivate or reassign a user	User reactivated	User reactivated	User reactivated (`active: true`)
Delete a user	User deleted, once permanently deleted in Entra ID	User stays deactivated. Okta doesn't send deletes	User deleted (`DELETE`)

User Provisioning Example

The following diagram depicts an example describing the steps required for each persona (IT Admin, End User) to perform their corresponding tasks and illustrate the general workflow for a SCIM integration with the Arcules Web Platform.

Other SCIM 2.0 identity providers

You can provision from any identity provider that supports SCIM 2.0. Select Other when enabling SCIM and configure your IdP with the details below.

Setting	Value
Base URL	The URL shown in the Arcules Web Portal after enabling SCIM, e.g. `https://scim.eu.arcules.com/scim`
Authentication	HTTP header `Authorization: Bearer <Secret Token>`
Resources	`/Users`, `/Groups`
User identifier	`userName`. Must be the user's email address

User attributes

SCIM attribute	Required	Notes
`userName`	Yes	Email address. Used as the Arcules login email
`name.givenName`	Yes	First name
`name.familyName`	Yes	Last name
`active`	No	`false` deactivates the user
`externalId`	Recommended	A stable, unique ID from your IdP. Can be used for matching
`preferredLanguage`	No	e.g. `en-US`, `ja`
`phoneNumbers`	No	The entry marked `primary` is used. International format, e.g. `+4512345678`

Other attributes, including `emails` and `password`, are ignored.

Group attributes

SCIM attribute	Required	Notes
`displayName`	Yes	Group name
`externalId`	Recommended	A stable, unique ID from your IdP
members`	No	`value` is the Arcules user `id`

Supported operations and queries

Users and groups: GET, POST, PUT, PATCH, DELETE.
Filters (operators eq and and only):
- Users: userName, emails.value, externalId, active, id.
- Groups: displayName, externalId, id.
Paging: startIndex and count.
Not supported: sorting (sortBy, sortOrder), the or and not operators, and bracketed filters such as emails[type eq "work"]. These return 400 invalidFilter.

SCIM Integration with Arcules