---
title: "Set Up SCIM"
canonical: "https://help.agiloft.com/space/HELP/778928159/Set%20Up%20SCIM"
format: markdown
---
This article explains how to set up System for Cross-domain Identity Management (SCIM) provisioning. The process involves creating a SCIM profile in your KB and then configuring your identity provider (IdP) to connect to the Agiloft CLM SCIM endpoint and provision users to your KB.

> ℹ️ **Prerequisites**
> ℹ️ 
> ℹ️ - To ensure your IdP can activate and deactivate users in Agiloft CLM when their status changes in the IdP, User Status Management must be deployed in your KB. To check if it’s deployed, go to **Setup > Access**. If you see a Deploy User Status Management button, click it to deploy the feature. If you see an Info button instead of a Deploy button, User Status Management is already deployed.
> ℹ️ - If users are already set up in your KB, SCIM updates the existing records rather than creating new ones. Incoming users are matched on the SCIM `userName` attribute. To ensure users are matched correctly, make sure the IdP sends a unique value for `userName` and that it matches the value in the Agiloft CLM field mapped to `userName` in the SCIM profile. By default, `userName` is mapped to the Login field.
> ℹ️ - Agiloft CLM can automatically map provisioned users to the Employees or External Users subtables based on the presence of the enterprise user schema extension. If you want to auto-map users to the appropriate subtable, make sure your IdP is configured to send the enterprise user attributes.
> ℹ️ - If you use SAML 2.0 SSO with just-in-time provisioning, we recommend disabling SAML provisioning after you set up SCIM. To disable SAML provisioning, edit your SAML profile and disable the Create and Update user options on the General tab.
> ℹ️ - At this time, synchronizing groups or teams through SCIM is not supported. To assign provisioned users to groups and teams automatically, configure default groups and teams in the SCIM profile. Support for group synchronization is planned for a later release.

# > Macro (anchor)

Set Up Agiloft CLM

Follow the steps below to set up a SCIM profile in your KB.

1. First, make sure User Status Management is deployed. Go to **Setup > Access**. If you see a Deploy User Status Management button, click it to deploy the feature. If you see an Info button instead, User Status Management is already deployed.
2. Now, go to **Setup > Access** and click Enable SCIM or Configure SCIM, depending on what you see:
  - **Enable SCIM**: SCIM isn’t enabled for your KB yet. Click Enable SCIM to deploy background tables for storing SCIM configuration details, bearer tokens, and logs. In addition, the deployment adds an External ID (SCIM) field to the People table (and its subtables) for storing identifiers sent by the IdP.  
When the deployment completes, click OK to start the setup.
  - **Configure SCIM**: SCIM is enabled. Click this button to configure SCIM.
3. On the Configure SCIM screen, click New to create a new SCIM profile.
4. On the Configuration tab, give the profile a unique name. Spaces and special characters are allowed.
5. Next, leave Enable SCIM Profile selected to enable the profile. If you want to disable it for now, you can clear the checkbox.
6. Now, choose which provisioning modes to enable. By default, all user modes are selected. Provisioning modes determine which user lifecycle changes Agiloft CLM accepts from your identity provider. If you want to disable any modes, clear the checkbox next to the option:
  - **Create user**: Create user records when new users are added to the IdP.
  - **Update user attributes**: Update user information when it changes in the IdP.
  - **Deactivate user**: Deactivate users when they’re removed or deactivated in the IdP.
7. Click Next.
8. On the Bearer Tokens tab, copy the KB SCIM Service Base URL and save it in a location you can access later. You’ll need this URL when you configure the IdP.
9. Now, generate a bearer token:
  1. Click Generate Token to open the token dialog box.
  2. Enter a Label for the token and click Generate Token at the bottom of the screen.
  3. Now, click Copy Token to copy the token. Save it in a secure location. You’ll need this token when you configure the IdP.  
:warning: **Make sure you copy the token now. It won’t be displayed again.**
  4. Click Save to save the token and close the dialog box.

> ℹ️ To allow you to rotate credentials without interrupting provisioning and support integrations that require separate credentials, a SCIM profile can have multiple bearer tokens. For more information, see [Manage Tokens](https://agiloft-public.atlassian.net/wiki/spaces/HELP/pages/779091993/Manage+SCIM#Manage-Tokens).

11. Click Next to configure SCIM attribute mapping.
12. On the User Attributes tab, select the table to map to:
  - **Recommended (auto-detect)**: This is the default and recommended option. With this method, Agiloft CLM automatically creates users in the Employees or External Users subtables based the presence of the enterprise user extension. If the enterprise extension is included in the SCIM request, the user is added to Employees. If it isn’t, the user is added to External Users.
  - **Map all to specific subtype**: If you want all users to be provisioned to a single table, choose this option and select the table from the drop-down list.

> ℹ️ This setting can’t be changed once you save the profile.

13. Next, review the User Attribute Mappings. The list includes the standard SCIM user attributes. By default, each attribute is mapped to the most appropriate out-of-the-box Agiloft CLM field. Click Show more to display additional attributes or Show less to collapse the list.  
Agiloft CLM requires the `userName` and `externalId` attributes to be mapped. All other attributes are optional, and you can leave them unmapped if you don't need to synchronize them. To change a mapping, click the Agiloft CLM field and select a different field from the drop-down list. The available fields depend on the table you selected for Map to Table in the previous step.
14. Finally, select the default groups and teams to assign when new users are created. This step is optional, but users can’t log in to the system unless they're a member of a primary team and at least one group. If don’t set default groups and teams now, you’ll need to edit each new user record to assign groups and teams before that user can log in to Agiloft CLM. The default group and team settings are applied only when new users are provisioned with SCIM. They aren’t applied to existing user records.
  1. To assign default groups to all new users, select a group from Select Default Groups, or hold Ctrl and click to select multiple groups.
  2. To assign a default primary team to new users, select a team from the Select Default Primary Team drop-down list.
  3. If you want to assign additional default teams to new users, select a team from Select Default Teams, or hold Ctrl and click to select multiple teams.

> ℹ️ Groups control access to data in your KB, such as the tables users can see and whether they can view or edit records (see [Use Groups to Control User Access](https://agiloft-public.atlassian.net/wiki/spaces/HELP/pages/43714429)). Teams represent groups of users who work together. They’re used for sending notifications, assigning records, and configuring locale settings. A user’s primary team determines their default user interface (see [Use Teams to Shape User Experience and Workflows](https://agiloft-public.atlassian.net/wiki/spaces/HELP/pages/43713262)).

15. When you’re done selecting the default groups and teams, click Finish to save the profile.

Now that the SCIM profile is complete, the next step is to configure your identity provider to connect to the Agiloft CLM SCIM endpoint. 

# Configure the Identity Provider

Now that a SCIM profile is set up in Agiloft CLM, configure your IdP to connect to the SCIM endpoint and provision users to your KB. For help configuring the IdP, refer to your provider’s documentation. This section includes example Microsoft Entra and Okta setup instructions for reference, but you can integrate Agiloft CLM with any provider that supports SCIM 2.0.

When you complete the setup, keep these points in mind:

- If your SCIM profile is configured to auto-detect which subtable users are created in, make sure the IdP is configured to send the enterprise user extension attributes.
- Some identity providers require you to assign users to the SCIM application before they can be provisioned, while others let you define a broad provisioning scope. Make sure the users you want to provision are included in the application's provisioning scope.

## Connect to Entra

This section walks you through an example integration with Microsoft Entra. For details about SCIM in Entra, see Microsoft’s [documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups).

1. In Entra, go to the enterprise application for which you want to enable SCIM provisioning. For instructions on creating a new application, see Microsoft’s [documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups?utm_source=chatgpt.com#getting-started).
2. On the app management screen, click Provisioning in the left panel.
3. On the Get Started tab, click Connect your application.
4. On the New provisioning configuration screen, leave Bearer authentication selected as the authentication method.
5. In Tenant URL, enter the KB SCIM Service Base URL from the Agiloft CLM SCIM profile you created. For example: `https://example.agiloft.com/scim/v2`
6. In Secret token, enter the token you copied from your SCIM profile.
7. Click Test connection to test the connection to the SCIM endpoint. If the connection fails, make sure you entered the service URL and token correctly and then try the test again.
8. When the connection is successful, click create to save the provisioning configuration. The Overview tab is displayed.
9. Review the provisioning attribute mappings and make any changes needed for your environment. Then assign the users you want to provision and enable provisioning.

## Connect to Okta

This section walks you through an example integration with Okta. For details about SCIM in Okta, see Okta’s [documentation](https://help.okta.com/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_SCIM.htm).

1. In Okta, edit the SAML application for which you want to enable SCIM provisioning.
2. On the General tab under App Settings, select SCIM in the Provisioning field and save the change.
3. Now go to the Provisioning tab and click Edit.
4. In the SCIM connector base URL field, enter the KB SCIM Service Base URL from the Agiloft CLM SCIM profile you created. For example: `https://example.agiloft.com/scim/v2`
5. In Unique identifier field for users, enter `userName`.
6. Under Supported provisioning actions, enable Import New Users and Profile Updates, Push New Users, and Push Profile Updates. You can also select the Group actions for future use, but Agiloft CLM doesn’t support provisioning groups at this time.
7. For Authentication Mode, select HTTP Header, then enter the bearer token you copied when you set up the Agiloft CLM SCIM profile.
8. Click Test Connector Configuration to test the connection to the SCIM endpoint. If the connection fails, make sure you entered the base URL and token correctly and then try the test again.
9. When the test is successful, click Save to save the provisioning configuration and go to the To App settings.
10. Review the attribute mappings and make any changes needed for your environment. Then assign the users you want to provision and enable provisioning.

Once provisioning to Agiloft CLM is enabled in your IdP, user records are automatically created and updated according to your IdP’s provisioning schedule.

#### Related articles

> Macro (contentbylabel)