SCIM provisioning
Synchronize directory members and groups without granting implicit infrastructure access.
System for Cross-domain Identity Management (SCIM) provisioning synchronizes organization members and team membership from an identity directory. Authentication and resource authorization remain separate from directory synchronization.
Create a directory connection
You have the Organization Owner role. Open Authentication → Provisioning, create a SCIM connection, and copy its endpoint and one-time credential into the identity provider. The endpoint uses SCIM 2.0 resources under the installation's configured provisioning URL.
The provisioning credential is limited to directory synchronization. It cannot create droplets or call the normal organization API. Store it in the provider's secret facility and rotate it independently of SAML signing certificates.
Match identity
Infra binds directory entries by connection and stable external ID. Usernames and email addresses are attributes; they are not a substitute for that binding. A renamed user updates the same member when the external ID remains stable.
An existing local member requires an approved identity link before synchronization can take ownership of its directory-managed fields. Matching an email string alone does not authorize merging two member records.
Groups and team bindings
Map selected directory groups to Infra teams. Synchronization updates the team membership; the team's existing role bindings determine effective permissions. A new directory group does not create an organization administrator role.
Removing a user from one group removes only that membership. Direct bindings and other team memberships can continue to grant access. Use the effective permissions view when validating offboarding.
Deactivation
Setting active=false disables normal member access and triggers session
revocation under the organization's policy. Resources created by that member
remain owned by their projects. Team ownership and operational contacts need
explicit reassignment when the departing member held those duties.
Personal credentials and separately owned service accounts have different lifecycles. Review those accounts during offboarding rather than assuming a directory user deletion revokes every automation credential they administered.
Partial synchronization
Provisioning requests can be retried. The connection records external IDs, request results, and rejected attributes so a repeated create can resolve the same directory object. Invalid required identity fields reject that entry without silently creating a partially identified member.
A directory outage leaves last applied membership in place. It does not remove all users because a sync did not arrive. Alert on connection errors and failed deactivation requests, and retain a tested recovery owner outside the managed directory path.
See single sign-on, custom roles, and Service Account API for the other access boundaries.