How SCIM works in HCP

This topic provides information about user and group lifecycles, SCIM statuses, and other concepts.

Quotas and limits

To ensure optimal performance and prevent sync issues, HCP enforces quotas for SCIM provisioning. For current quota limits and to request increases, refer to the HCP support page.

User and group statuses

When SCIM provisioning is enabled for your organization, HCP adds a SCIM provisioning column to the user and groups management pages in HCP. The SCIM provisioning column indicates whether the user or group is managed by the IdP over SCIM. Users and groups may have the following statuses:

Status	Applies to	Description
Synced	Users and groups	SCIM is enabled and the user or group is synchronized with your identity provider.
Not enabled	Users and groups	The user or group was provisioned through SCIM, but the SCIM is currently disabled.
Non-SSO user	Users	User is not managed by the identity provider and accesses HCP with their email and password or with their GitHub credentials.
Created via SSO	Users	User was created during sign-in through your SSO provider and is not managed by your identity provider.
Created in HCP	Groups	Group was created manually in HCP.

Conflict handling

When you enable SCIM provisioning, HCP checks your identity provider directory to determine if users or groups already exist in HCP. When HCP identifies an existing user or group, it handles the conflict in the following ways:

SSO users: Existing users who access HCP through SSO become managed by the identity provider.
Non-SSO users: Existing users who access HCP using non-SSO credentials remain manually managed users and are not managed by the identity provider.
Groups: HCP groups that have the same name as the a group managed by the identity provider are replaced by identity provider group. The identity provider begins managing the group's lifecycle and replaces all existing HCP group members with the members from your identity provider group.

User and group deactivation and reactivation

When you deactivate or reactivate a user or group in your identity provider, the following behavior occurs in HCP.

Deactivation

The identity provider deletes the user or group from HCP.
All roles associated with that entity are removed.

Reactivation

The identity provider creates the user or group in HCP as a new record.
You must reassign any roles for that entity in HCP.