---
title: "Provision Users with SCIM"
canonical: "https://help.agiloft.com/space/HELP/779649034/Provision%20Users%20with%20SCIM"
format: markdown
---
To automate user lifecycle management in your KB, you can integrate Agiloft CLM with any identity provider (IdP) that supports System for Cross-domain Identity Management (SCIM) 2.0. With SCIM, your IdP serves as the single source of truth for user accounts, automatically provisioning, updating, and deactivating users in your KB as changes occur in the IdP. When SCIM is enabled in Agiloft CLM, your IdP can:

- Create user records in your KB when users are added to the IdP
- Update user information in your KB when it’s changed in the IdP
- Deactivate users in your KB when they’re removed or deactivated in the IdP
- Reactivate users in your KB when they’re activated again in the IdP

With SCIM, user records in your KB stay synchronized with your identity provider throughout the user lifecycle. Instead of maintaining user accounts in multiple places, changes in your IdP are automatically reflected in Agiloft CLM.

> ℹ️ At this time, synchronizing groups and teams or custom attributes through SCIM is not supported. Support for group synchronization is planned for a later release.

## SCIM and SSO

SCIM doesn’t replace [Single Sign-on](https://agiloft-public.atlassian.net/wiki/spaces/HELP/pages/43718160) (SSO). SCIM automates user provisioning, updating, and deprovisioning, while SSO manages authentication. Although SCIM and SSO can be used independently, most organizations set up both for a complete identity management solution. If SSO is already set up, you can add SCIM any time. You can also set up SCIM first and add SSO later. SCIM is supported with both OAuth 2.0 and SAML 2.0 SSO methods.

### User Provisioning with SAML vs. SCIM

Like SCIM, SAML can use attributes from your IdP to create and maintain user records in your KB. The primary difference between SAML and SCIM is when provisioning occurs. With SAML, users are provisioned or updated when they sign in to Agiloft CLM. With SCIM, users are provisioned and updated automatically based on changes in the IdP. The table below shows how each approach responds to common user lifecycle events.

| **User Event** | **SAML** | **SCIM** |
| --- | --- | --- |
| A new user is onboarded in the IdP. | A new user record is created in your KB automatically once the user logs in with SAML. | A new user record is created in your KB automatically according to the IdP’s provisioning schedule. |
| A user’s information is updated in the IdP. | The user record is updated automatically the next time the user logs in with SAML. | The user record is synchronized automatically from the IdP and kept up to date through sync cycles. |
| A user is deprovisioned in the IdP. | The user record remains active until manually deactivated. | The user is deactivated automatically by the IdP. |
| Agiloft CLM records need to be assigned to users. | Users can’t be assigned to records, such as contracts, tasks, or approvals, until after they’ve logged in for the first time. | User records are created in advance of users logging in for the first time. Users can be assigned to records before they enter the system. |

While both SAML and SCIM can automate aspects of user provisioning, SCIM provides more comprehensive lifecycle management, including automatic deactivation when users are removed from the IdP. For this reason, Agiloft recommends that you use SCIM for user provisioning and SAML only for authentication, not for creating or updating user records.

To get started with SCIM integration, see [Set Up SCIM](https://agiloft-public.atlassian.net/wiki/spaces/HELP/pages/778928159).

#### Related articles

> Macro (contentbylabel)