SCIM Provisioning

In organizations of any real size, user accounts don't just get created once — they change constantly: new hires need accounts across a dozen tools, role changes need permission updates everywhere, and departures need every account disabled promptly, not eventually. Doing this by hand, application by application, both wastes admin time and creates a security gap: a departed employee's forgotten account in some tool is exactly the kind of access an audit finds too late.

SCIM standardizes this as a protocol between an identity provider (where an organization manages its actual roster of employees) and each connected application: when someone's added, changed, or removed in the identity provider, SCIM pushes that change out automatically to every application that supports it, keeping accounts in sync without manual replication.

Deprovisioning is usually the piece that matters most in practice — SSO controls whether someone *can* log in with valid credentials, but SCIM is what ensures an account is actually disabled, not just no longer used, the moment someone leaves. Without it, "offboarding" tends to mean remembering to manually disable access in every tool, which reliably doesn't happen consistently at scale.