Accounts from your employee directory (SCIM)
Your employee directory should create the accounts in the portal, suspend them, and give them roles, instead of someone maintaining both.
5 minute readOrganizationUpdated: 10/25/2026
On this page
Before you start
- For
- Owners whose organization maintains an employee directory — Microsoft Entra ID, Okta, or comparable products
- Prerequisite
- an active sign-in method through the company account (the three stages of company sign-in), the permission to manage provisioning, and access to the administration of your directory service
- Where in the portal
- Settings › Organization › Company sign-in, section 4. Provisioning (SCIM)
After this page, your employee directory creates the accounts in the portal, suspends them when someone leaves, and assigns the roles. Nobody maintains everything twice, and nobody forgets the second step.
The order is not a recommendation but a condition: An account created this way gets no password and signs in exclusively through the company account. As long as no provider is active, the buttons are therefore replaced by the note Login provider first, provisioning second.
Steps
1. Create the roles that should exist
A group in the directory corresponds to a Role in the portal, and the role is created here, not there. Under Team › Roles, create what you need, and name the group in the directory exactly the same later. It does not work the other way around: What a role may do is decided by you, and it is not stored in any directory group. How roles are created is explained in Create custom roles and grant direct permissions.
2. Issue the token
- Open Settings › Organization › Company sign-in and go to the section 4. Provisioning (SCIM).
- Click Issue token. The message Token issued. appears.
- The box SCIM token — visible only now shows the value exactly once. It never appears again: “Enter the value in your directory service now. It is never shown again; losing it means rotating.” Copy token puts it on the clipboard, and Got it closes the box.
- Note down the address next to it under Enter this address in your directory service. It ends in
/scim/v2.
3. Enter it in the directory service
- In your directory service’s administration, enter the address from step 2 as the provisioning target and the copied value as the secret token.
- Run the connection test there. It should pass the first time.
- Create the groups with exactly the names that the roles have in the portal, and assign the people to them.
Options
Rotate changes the value without stopping provisioning: The previous token remains valid alongside the new one until the period in the Rotation in progress banner has expired. The default is 24 hours. That leaves time to enter the new value over there, even if an approval step is in between.
Revoke stops everything. The prompt Revoke SCIM token says so: “Provisioning stops afterwards: joiners and leavers no longer arrive until you issue a new token and enter it in your directory service.” A rotation still in progress is revoked as well.
What applies afterwards
| Question | Answer |
|---|---|
| Who runs these accounts? | The directory. As soon as the sync runs, it decides status and role. If you change either by hand here, the next sync resets it. The portal says so in the card The directory owns these accounts. |
| How many roles does an account carry? | Exactly one. If someone is in two groups, the one assigned last applies. |
| What happens when someone is removed from a group? | The account falls back to the role Member, not to “none at all”, because an account without a role would get in and see nothing. |
| What happens when someone leaves? | The account is suspended, not deleted. Log entries, uploaded media, and created schedules are attached to the account. Whoever took it away would take away your proof of who did what. Permanent deletion remains a deliberate step in the portal. |
| How do I recognize a change triggered this way? | In the change log, the originator is the directory, not a person. |
Check the result
- In the section 4. Provisioning (SCIM), it says Issued on … and, after the first sync, additionally Last used on … As long as nobody has checked in, it says Never used — the directory has not called yet.
- Under Team › Members, the accounts from the directory appear with the role of their group.
- An account deactivated in the directory is Suspended in the portal.
If something goes wrong
| Symptom | Meaning | Solution |
|---|---|---|
| No enterprise login provider is active. Set up step 1 first. | There is no active provider. A provisioned account would get in nowhere. | Set up company sign-in and switch the provider to Active. |
| A token already exists. Use “Rotate” to replace it. | There is exactly one token per organization. | Use Rotate instead of Issue token. |
| The value is lost before it was entered | It is displayed only once and stored nowhere afterwards. | Rotate, and enter the new value right away. |
| The directory service reports an unknown group | The group has no counterpart: Roles are created in the portal, not through provisioning. | Create the role under Team › Roles and name the group over there exactly the same. |
| A role changed by hand jumps back | The next sync restored the state of the directory. | Make the change in the directory, not in the portal. |
| Joiners and leavers no longer arrive | The token is revoked, or the period of a rotation has run out and the new value is not yet entered over there. | Issue a token, or enter the new value in the directory service. |
Related
- Set up company sign-in (SSO) — the three stages that come before this one.
- Create custom roles and grant direct permissions — where the names come from that your groups must carry.
- Manage members: change role, block, remove — what remains for you to do by hand with these accounts.
Found what you needed? Then carry on in the portal — or set up an organization first.
Go to the portalTry it free