Cursor SCIM Provisioning: Setup, Directory Groups & Spend Limits

• Cursor Enterprise plan (contact sales if SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. is not visible).
• SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. already working - SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. requires an active SAMLAn enterprise standard that powers single sign-on. connection.
• Admin access to your IdP (Okta, Entra ID, Google Workspace, etc.) and Cursor org admin.

1. 1Confirm SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. login works for a test user.
2. 2Open Dashboard → Members & Groups → Directory Groups (or the Active Directory subtab).
3. 3Start the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. setup wizard after SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. verification and copy the endpoint and bearer token.
4. 4In your IdP, create or configure the Cursor SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. app; enable user and group push provisioning; run a connection test.
5. 5Optionally set per-group spend limits on synced directory groups in Cursor.

• Users: they must be explicitly assigned to the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. application in the IdP, not only in a group elsewhere.
• Groups: confirm group push provisioning is enabled and groups are assigned to the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. app.
• SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. UI hidden: SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. is not verified yet; fix SAMLAn enterprise standard that powers single sign-on. before SCIM controls appear.

Directory groups (SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave.) drive identity and optional spend limits. Billing groups attribute usage for chargebacks and can also sync from IdP groups but serve finance reporting. They are related concepts with different dashboards; large orgs often use both. See the billing groups guide for spend attribution rules.