SCIM provisioning

This topic provides information about SCIM (System for Cross-domain Identity Management) provisioning on HashiCorp Cloud Platform (HCP). SCIM provisioning enables automated user and group management for your HCP organization. When you enable SCIM, changes you make in your identity provider (IdP) automatically sync to HCP, eliminating the need for manual user invitations and group management.

What is SCIM?

SCIM is an open standard that enables automated user provisioning and deprovisioning between IdPs and service providers. With SCIM enabled on HCP, your identity provider becomes the source of truth for user and group information.

SCIM differs from manual provisioning in the following ways:

Automated synchronization: Your IdP automatically creates, updates, and removes users and groups in HCP.
Centralized management: You IdP manages user and group lifecycles.
Real-time updates: Changes from your IdP sync to HCP automatically.

User and group lifecycle

With SCIM provisioning enabled, your identity provider manages the complete lifecycle of users and groups in HCP. As a result, you do not need to manually invite users or create groups in HCP. The following IdP operations automatically sync to HCP:

Create users
Modify user attributes
Deactivate or delete users
Create groups
Modify group information
Delete groups
Add or remove group members

Supported identity providers

HCP supports SCIM provisioning with the following identity providers:

Identity provider	Vendor documentation	Instructions for HCP
Microsoft Entra ID	Enable single sign-on for an enterprise application	Configure SCIM for Entra ID
Okta	Add a private SSO integration	Configure SCIM for Okta
Ping ID	Add a SAML application	Refer to the vendor documentation
IBM Verify	Contact IBM Verify support for SCIM configuration guidance	Contact IBM Verify support for SCIM configuration guidance

Workflow

Complete the following steps to begin using SCIM provisioning in your HCP organization:

Verify that SAML single sign-on (SSO) is configured in HCP for your IdP. SAML SSO is required to enable SCIM. Refer to Single sign-on overview for more information.
Enable SCIM provisioning on HCP to obtain the credentials needed for configuration with your identity provider.
Provide the HCP credentials to your IdP.
Map IdP attributes to SCIM attributes in HCP.

After configuring your IdP integration, you can define roles for provisioned users and groups. Refer to Access Management for more information.

Guidance

Refer to the following topics for details: