What is SCIM Provisioning: In-Depth Guide [2024]

The ability to outsource and automate repetitive daily tasks is at the core of why SCIM provisioning exists.

In the case of large and medium scale enterprises, when an employee joins a new company for example, they usually require access to all of the necessary tools needed to perform their duties.

This then means that new accounts have to be created with all the right user privileges and packages.

We could flashback to the pandemic when everyone practically went remote and we had to rely on a bunch of software tools to stay productive at work.

Even now, employees of large and medium firms still rely on several different cloud based apps to carry out their daily jobs.

However, we can imagine that when dealing with thousands of users spanning several different cloud based user accounts, this repetitive cycle of handling new cloud identities can easily get complex and untidy if not properly automated. Besides, it could create footprints for security attacks.

What is SCIM provisioning?

One effective way to solve this problem of creating many different user accounts per need is through SCIM provisioning. SCIM provisioning involves setting up an automated workflow that caters to the following needs:

1. Assigning new user accounts or provisioning users
2. Updating roles and access levels as needed
3. Safely removing user identites when they are no longer in use, also known as de-provisioning users.

The System for Cross-domain Identity Management(SCIM) is an open web standard that serves this purpose of providing a way to easily authenticate users of your app across third party services.

How SCIM Works

The SCIM server is a made up of restful API with available endpoints. Information is exchanged over a secure communication protocol. The SCIM client is expected to make a HTTP request call to the server and receive a matching response.

By providing a standardized API and data model, SCIM makes automated user provisioning, de-provisioning and management possible across various clouds apps.

Let's throw more light into the illustration above. We usually have 3 key players involved in the workflow of creating user accounts (otherwise called provisioning) using SCIM standard:

1. the SCIM Client which is the Identity Service Provider (IdP)
2. the SCIM service provider
3. and the cloud apps.

The IdP which has a record of the organizations' user identities initiates requests to the SCIM service provider. Next, the SCIM service provider makes the appropriate changes automatically to all the connected cloud applications.

SCIM defines resources such as User, Group, and ServiceProviderConfig

Each of these resources we just mentioned come with a set of attributes. For example, a User resource includes attributes like userName, emails, displayName, name.

We can also extend the schema contents to include attributes that are specific to our own usecases so it doesn't have to be fixed.

Now, let's have a look at some of the common API operations that can be performed on the SCIM server:

1. Create: This operation provisions new user and makes a record of their identity on the SCIM data store.
2. Read: The read operation fetches user identities from the data store.
3. Update: This make changes to the user identities e.g user changing roles when an employee is promoted.
4. Delete: The delete operation removes existing resource types from the SCIM data store e.g deleting employee records.

How to implement a custom SCIM Server?

Since SCIM is an open standard, it means we can build our own SCIM server customized to suit specific needs. Once the fundamental ingredients as defined in the specification documents are fulfilled, implementing your customized SCIM server is achievable.

Here is a general overview of the steps to implement your custom SCIM:

1. Understand the SCIM standard and RFCs
2. Define your organizational specific requirements identifying which user and group management functionalities you need
3. Select the technology stack to build your own SCIM variant ensuring it supports Restful API and secure communication protocols
4. Design your data model making sure it is in line with SCIM's core resource type which are: Users and Group.
5. Next, implement the core SCIM endpoints based on the specifications.
6. Implement security. Ensure authentication workflow is secured with OAuth or other means and all exchanges are conducted on HTTPS.
7. Develop error handling and logging.
8. Test and proper documentation
9. Deployment, monitoring and scalability

A minor slack in this custom implementation might open up a window for security mishaps. Thus, most efficient developer teams usually opt for outsourcing this crucial part of the piece.

In the following sections, we will talk in more details about using a third party SCIM services and everything you need to know to make the right choice.

How to Evaluate SCIM providers?

What truly makes the difference is a SCIM provider that fulfills your organizational needs to a considerably large extent. Of course, jumping on just about any shiny new product in the market is not advisable.

Therefore, in this part, we shall talk about the important features you need to look out for when weighing and eventually selecting a SCIM provider to go with.

Key features to look for in SCIM providers

1. Compatibility with existing systems: You'll want to look out for a provider that makes it easier to plug into your existing company software without breaking it. This ensures to get SCIM up and running without delays.

2. Ease of integration and deployment: A simplified integration process reduces downtime. This is especially important in a business environment where swift deployment provides a competitive advantage.

3. Security features and compliance : When selecting a SCIM provider, it is essential to ensure they offer robust security features and are compliant with relevant industry standards and regulations such as GDPR and HIPAA Compliance to name a few.

4. Scalability and performance: Consider a SCIM provider that can meet the growing needs of your organization or user base.

5. Customer support and documentation: Timely customer support and well crafted documentation is an indication that the SCIM provider is reliable and ready to assist.

Factors influencing the choice of a SCIM provider

1. Company size and requirements: A small startup would need to provision less user accounts compared to a medium or large enterprise. So, it's important to pick a SCIM provider with a cost effective package.

2. Budget and pricing considerations: The allocated amount a company plans to spend on SCIM resources needs to work with the pricing of the chosen SCIM provider.

3. Specific use cases and industry needs: It's essential to align the features offered by the SCIM provider with your specific industry to know if it can effectively support your organization's identity management requirements.

What are the Top SCIM Providers?

In this section will expand even more into what options exists. 

As we take a closer look at the top 5 SCIM providers in the market for 2024, it will help to bear in mind your pressing organizational needs with matching how each provider might possibly fit.  

Provider 1. Okta

Okta can be described as an all-in-one identity solution. Users are provisioned using SCIM through the Okta Lifecycle Management (LCM). This ensures that events are triggered at each point whenever any user changes occurs, such as joining or leaving your organization.

Key Features of Okta

• Comprehensive identity and access management.

• Integrates with a wide range of applications and services allowing for seamless connectivity across different IT environments.

• Advanced security features like adaptive multi-factor authentication (MFA) and threat insights.

• Lifecycle management to facilitate automatic user provisioning and ensures that data is quickly synchronized as users' come in or leave the organization.

• A centralized directory for managing all your user profiles in one place.

Pros

• Strong emphasis on security and compliance.
• Scalable solution suitable for enterprises of all sizes.
• User-friendly interface and extensive support resources.

Cons

• Higher cost compared to some competitors.
• Complex setup which might require some technical know-how.

Pricing
Okta’s pricing varies based on the specific modules and services used. Basic plans for single sign-on (SSO) start around $2 per user per month, with advanced features and enterprise packages costing significantly more.

Provider 2. WorkOS

WorkOS aims to provide enterprise-grade identity management solutions for your app to help you ship without needing extensive resources or time. It includes a Directory Sync to help you 'build a frictionless user provisioning and deprovisioning workflow for your organization.'

Key Features of WorkOS

• Developer-centric with robust APIs and SDKs for backend technologies such as PHP, Python, NodeJS.

• Real-time event streaming for provisioning events which gives a better way to update data compared to using webhooks.

• A customizable user interface for authentication that supports various authentication types, making it easier for developers to implement secure login flows

• Directory Sync for user lifecycle management by syncing with corporate directories like Google Workspace, Azure AD, and more.

• Audit logs to maintain regulatory requirements and security standards.

Pros

• Easy integration with major identity providers (IdPs) and Human Resources Information System (HRIs).
• Flat-rate pricing simplifies budgeting.
• Excellent documentation and developer support via Slack.

Cons

• Flat-rate pricing may not be cost-effective for smaller organizations.
• Limited to the features included in their predefined plans.

Pricing
WorkOS charges $125 per company per month for its SCIM Directory Sync, with discounts for bulk purchases. Custom enterprise plans are also available with additional support and SLAs.

Provider 3. Frontegg

Image credit: Frontegg

Frontegg is built with the goal of modernizing user management for B2B Saas organizations. As shown in the screenshot above, via the admin portal in the dashboard, you can easily set up SCIM provisioning, connect your identity provider and sync data.

Key Features of Frontegg

• Full suite of authentication services, including SCIM provisioning.

• Advanced security features like behavioral analytics, bot detection, robust encryption and more.

• Customizable admin portal where users can manage their profiles, team memberships, roles, and permissions.

• Supports a variety of front-end frameworks (React, Angular, Vue, etc.) and provides robust SDKs and APIs for easy integration and customization.

• Offers tenant settings, entitlements, fine-grained authorization, and multi-tenancy management, making it suitable for complex organizational structures.

Pros

• Strong security features tailored for large tech companies.
• Supports a wide range of IdPs.
• Self-service configuration through an admin portal.

Cons

• May require significant setup knowledge for full utilization.

Pricing
Frontegg’s pricing is primarily based on Monthly Active Users (MAU). Specific pricing details are available upon contacting their sales team, making it less transparent compared to competitors like WorkOS.

Provider 4. Stytch

Stytch offers SCIM provisioning as part of its B2B authentication suite. It facilitates user identity management by providing the relevant SCIM APIs, integrating with the IdP and effecting user changes using webhooks.

Key Features of Stytch

• Focus on modern authentication methods like passkeys and biometric auth.

• Stytch supports SCIM integration with popular IdPs such as Okta.

• Users can enable SCIM provisioning for their existing SAML applications by configuring SCIM connections through the Stytch dashboard or API.

• Lightweight and easy-to-integrate solutions.

• Implements fine-grained access controls, allowing organizations to define roles and permissions at an organizational level.

Pros

• Cost-effective for basic SCIM provisioning needs.
• Quick and straightforward integration.
• A good fit for startups and smaller businesses.

Cons

• Less feature-rich compared to other providers.
• Limited support for large-scale enterprise needs.

Pricing
Stytch offers competitive pricing based on MAU, with plans starting at $0.05 per active user per month. They provide a transparent pricing model with additional features available at higher tiers.

Provider 5. OneLogin

OneLogin aims to provide a trusted experience platform with secure, scalable and intelligent experiences.

By integrating SCIM, OneLogin ensures that user data is synchronized and updated in real-time across all connected applications, reducing administrative overhead and enhancing security.

Key Features of OneLogin

• Complete access management tools designed to monitor user access within an enterprise IT ecosystem.

• Strong integration capabilities with various applications and services.

• Advanced and adaptive authentication methods to safeguard user credentials and increase security defenses.

• Real-time cloud directory which synchronizes users in your directory to thousands of apps in real-time.

• Compliance analysis and reporting to provide audit logs which can be used to generate useful statistics.

Pros

• Ease of use and simple integration.
• Robust security features, including adaptive authentication.
• Scalable for enterprises of various sizes.

Cons

• Can be expensive for smaller businesses.
• Some users report a steep learning curve for advanced features.

Pricing
OneLogin’s pricing starts at around $2 per user per month for basic SSO and increases with additional features and enterprise requirements.

Comparison table of the top SCIM providers

Factor	Okta	WorkOS	Frontegg	Stytch	OneLogin
Compatibility	Supports a wide range of apps and services	Integrates with major IdPs and HRIS	Broad IdP support and custom integrations	Focused on modern auth methods	Extensive app and service compatibility
Ease of Integration	User-friendly with extensive resources	Developer-centric with robust APIs/SDKs	Self-service admin portal for easy setup	Lightweight and easy to integrate	Easy to integrate
Security Features	Advanced security, adaptive MFA, threat insights	Real-time event streaming, SOC 2 certified	Behavioral analytics, advanced security suite	Basic security features, passkey auth	Adaptive authentication, robust security
Pricing	From $2/user/month, higher for advanced features	$125/company/month, discounts for bulk packages	$0.05/MAU, higher tiers available	Starts at $2/user/month, increases with features	Starts at $4/user/month
Customer Support	Excellent support, including 24/7 availability	Excellent and dedicated support	Excellent support	Great customer support	Good and quick support
Documentation	Excellent, user-friendly documentation	Best-in-class documentation and API references	Good documentation for developers	Extensive and clear documentation	Good documentation for developers

Testimonials from organizations that have benefited from using SCIM

SCIM is rapidly gaining adoption by high tech companies as an effective way of identity management.

For instance, here's what the Director of Product for Indeed, a leading employment website noted :

"Instead of having to jump on a call with the customer, stand by for 30 minutes to redeploy the login app to activate the SSO connection, the Admin Portal allowed the team to consolidate onboarding into just a few, self-serve steps." - Abishek Chhibber, Director of Product, Indeed

How to make the right choice?

In conclusion, we have talked about how SCIM simplifies identity management and ensures productivity as well as how SCIM works.

Most importantly, we have discussed things to consider in choosing a SCIM provider along with recommendations based on specific use cases.

Common pitfalls to avoid during selection process

Choosing a SCIM provider can be a weighty decision. Let's look at some common pitalls engineering teams face. 

• Overlooking compliance of SCIM providers: The SCIM protocol is an open standard. This means it states some guidelines and rules for implementing it. Meanwhile, different SCIM providers might translate the guidelines in their own way.

Engineering teams wouldn't want to be in a rush rather should make sure to check that the SCIM provider actually follows the standard.

• Failure to evaluate compatibility: One common mistake developer teams make is not doing a proper analysis on their existing legacy software to determine if it can easily support SCIM integration. This leads to delay in the overall implementation timeline, risk of server errors and cost implications.

• Setting wrong expectations: The SCIM standard is not a one-size-fits-all. Thus, expecting that it will instantly solve all your identity management problems is not the most realistic thing to do. For instance, your IdP (Identity Provider) or SCIM client might not work out of the box with every SCIM service without adding extra customizations here and there. So it's to important to manage expectations.

SCIM Provider recommendations based on specific needs and scenarios

1. Education Use Case: Managing student, faculty, and staff identities across various systems.

Industry Needs: Scalability, ease of integration, and user-friendly interfaces

Features to Look For:

• Scalability: Ability to handle a large number of users and fluctuations in user numbers throughout the academic year.

• Ease of Integration: Compatibility with existing educational systems and platforms like LMS (Learning Management Systems).

• Self-Service Portals: Enabling students and staff to manage their accounts independently, reducing the administrative burden

SCIM Provider Recommendations
Okta, Frontegg, OneLogin

1. Healthcare Use Case: Managing access to sensitive patient data and complying with regulations like HIPAA

Industry Needs: High security, stringent compliance, and detailed auditing.

Features to Look For:
HIPAA Compliance: Ensures the SCIM provider follows strict guidelines for protecting health information.

Advanced Security Features: Including encryption, multi-factor authentication (MFA), and automated provisioning/de-provisioning to maintain secure access controls.

Audit Trails: Detailed logging and monitoring to track access and changes to patient data

SCIM Provider Recommendations
Okta, WorkOS, OneLogin

Related Reading

• Provisioning with SCIM – getting started
• Build Scalable Authorization systems with Permify
• The 10 most common pitfalls for SCIM 2.0 compliant API implementations
• Don't SCIM over your Data Model
• Deciphering SCIM Complexity: Navigating Group Fragmentation

Comments

[Arie Timmerman]

Excellent overview! For anyone interested in exploring Okta and SCIM provisioning further, I highly recommend checking out Okta's comprehensive guide on integrating with the SCIM Playground. It’s a great resource for hands-on learning and understanding the integration process.