Administration/Sign-in
SCIM provisioning
Create SCIM connectors in Admin Center, map groups, and provision workspace members from your IdP.
Use this article to provision workspace members automatically from your identity provider with SCIM 2.0 instead of inviting people one by one.
SCIM is part of the SSO / SCIM add-on. Your plan must include it, and a workspace admin must enable SSO / SCIM under Settings → Advanced before provisioned members appear in that workspace.
What SCIM does in Clipido
SCIM creates and updates user records from your IdP. For each deployment you attach to a connector, Clipido:
- Adds members who should have access
- Updates names and active status
- Assigns groups based on your mapping rules (depending on assignment mode)
- Shows provisioned members on Settings → Members with a "SCIM" badge
SCIM does not replace SAML sign-in. Most organizations use both: SAML for authentication and SCIM for user lifecycle.
Create a SCIM connector
-
Open Admin Center → "Identity" → "SCIM Provisioners".
-
click Add Provisioner.
-
Enter a "Display Name".
-
Under "Assign to deployments", select the workspaces this connector manages. Each deployment can attach to "only one connector".
-
For each deployment, choose a "Fallback access group". This group is used when no SCIM group mapping resolves for a user signing into that deployment.
-
choose SCIM group assignment mode:
Mode Label Behavior Manual "Manual: allow moving SCIM users between groups" Admins can adjust group membership in Clipido Enforced "Enforced: SCIM controls group assignments" Group membership changes must come from the IdP -
Save and copy the bearer token from "SCIM Token Generated". The dialog warns "Copy the token below. It will not be shown again."
Configure your IdP with:
- "Base URL:"
https://{api-host}/scim/v2(shown on the SCIM tab) - "Bearer token:" the token you copied
Map SCIM groups to Clipido groups
After the connector is active and the workspace toggle is on:
- Open Settings → Groups in the workspace app.
- Open a group and go to Members.
- In "SCIM mapping", click Map SCIM group and link IdP group identifiers to Clipido groups.
Provisioned members also appear under Settings → Members → "Provisioned members" with the count "{n} users whitelisted via SCIM for this workspace."
SCIM limitations to plan for
The table below lists hard limits that affect how you configure your IdP sync.
| Limit | Detail |
|---|---|
| List page size | SCIM list endpoints return at most "100" results per request |
| Manual removal | SCIM-managed members cannot be removed in Settings → Members |
| Manual group edits | Disabled when assignment mode is "Enforced", or for SCIM-managed rows |
| Deactivation | SCIM DELETE deactivates access but keeps the identity row |
| One connector per deployment | A deployment cannot attach to two connectors |
For SCIM-managed members, "Remove" is disabled with the tooltip "This member is managed by SCIM. They cannot be removed from the workspace here." Remove or deactivate them in your IdP instead.
Enable SCIM on the workspace
Turn on SSO / SCIM under Settings → Advanced. The card description reads "Provision members from your identity provider and manage SCIM whitelisted users."
Without this toggle, SCIM API calls may succeed at the organization level but the workspace UI will not show provisioned members or honor group mappings.
Troubleshooting
| Problem | What to check |
|---|---|
| Users not appearing | Connector assigned to the deployment, workspace toggle on, IdP sync running |
| Wrong groups | SCIM mapping on Settings → Groups, assignment mode (manual vs enforced), fallback group |
| Cannot move a user between groups | Connector may be in "Enforced" mode; change groups in the IdP |
| Token lost | Create a new connector or rotate the token in Admin Center; old tokens cannot be viewed again |
If members can sign in with SSO but SCIM users never appear, confirm the connector lists the correct deployment and the fallback group exists.