Cursor SCIM Provisioning: Setup, Directory Groups & Spend Limits

SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. rides on top of SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., so the gating item is an active SSO connection.

You also need the Enterprise plan and admin access on both sides, in Cursor and in your identity provider. Without the plan and a verified SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. connection, the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. setup link never appears.

• The Cursor Enterprise plan. Contact sales if SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. isn't visible.
• SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. configured, with your domain verified and a test user signing in.
• Admin access to your identity provider, such as Okta, Entra ID or Google Workspace, and admin access to your Cursor team.

Treat SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. as its own project, with its own test plan and rollback, and start SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. once SSO is verified. If you try to land both in one change window, SSO problems can use up the window and leave provisioning untested after everyone has switched over.

Settle who owns each half before you start. Setup needs an admin on the Cursor side and an admin on the identity provider side, who are often different people with different queues. For provider-specific steps, Cursor links to WorkOS integration guides covering Okta, Azure AD, Google Workspace and others.

The steps here set up SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. for a single team. An Enterprise Organization can also connect SCIM once, for every team: each identity provider connection has a SCIM Directory section in the organization's settings, where Sync Directory registers it. Admins then choose which directory groups to sync in as Organization Groups, which can keep team membership in line with the directory. Every synced user also lands in the root team unless you turn off Auto Add Users to Root Team.

Once SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. is live, membership stops being something you manage in Cursor. Users and directory groups sync in from your identity provider, and Cursor shows both as read-only. Spend limits are the part you still set in Cursor, on the synced groups.

The bigger change is where you fix problems. Membership becomes something the directory does, so the Cursor dashboard is no longer where you repair a membership mistake. Roles are the exception. Team-level SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. doesn't set them, so admins still assign roles in the dashboard, unless an Enterprise Organization maps a synced group to the team with a role (members and roles has the detail).

SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. doesn't remove existing users when it comes online. Remove them from the members dashboard, or sync them once through SCIM and then deprovision them from the identity provider, which leaves the directory holding the whole record. Skip this and the members list runs longer than the directory group, with nobody sure which list is right.

A directory group limit takes precedence over the team's default per-user limit, and someone in several groups gets the highest group limit that applies. Set a conservative team default, then give the groups that need room a higher limit.

Setup runs across two consoles. You copy an endpoint and a token out of Cursor, wire them into the Cursor SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. app in your identity provider, then push users and groups. Confirm SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. works first, because the setup wizard appears only once SSO is verified.

1. 1Confirm SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. login works for a test user.
2. 2Open Dashboard → Members & Groups → Directory Groups (the Active Directory subtab).
3. 3Once SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. is verified, follow the link to the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. setup wizard, and copy the endpoint and token.
4. 4In your identity provider, create or configure the Cursor SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. app, enable user and push group provisioning, and run a connection test.
5. 5Optionally, set per-group spend limits on the synced directory groups in Cursor.

Two parts of that sequence fail quietly. Group sync is configured separately from user sync, so a first run that brings in people but no groups usually means push group provisioning is off. A provisioned user also doesn't appear on the members dashboard until their first sign-in, which looks like a partial sync but isn't one.

Run the connection test before you push everyone. Sync is real time, so an attribute-mapping mistake reaches every assigned user at once, and it is far cheaper to find with four users assigned than with four hundred.

Cursor's SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. docs trace missing users and groups to settings in the identity provider. Check these three causes.

• Users must be assigned to the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. application explicitly. Being in a group elsewhere isn't enough.
• Groups need push group provisioning turned on, and the groups themselves must be assigned to the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. app.
• Hidden SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. controls mean SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. isn't verified yet, so fix SSO before anything else.

Assignment is the cause behind most of that list, because SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. only sees what the identity provider hands to the Cursor SCIM application. The docs give the same cause when spend limits don't apply. The limit follows group membership, so someone who is in the group in your directory but not in the pushed copy gets the team default instead.

If a change doesn't land at all, the fix is in the directory, because SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. users and groups are read-only in Cursor. Tell that to the admin who has spent twenty minutes looking for a button that isn't there.

Directory groups come from SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. and set spend limits and policy within a team. Billing groups attribute usage for chargebacks and reporting, and they can also sync from identity provider groups. The two live on different dashboard tabs, and a large organization can run both.

That shared source is why they get confused. A directory group decides what someone may spend and which policies apply. A billing group decides whose budget the spend is reported against. One reorg touches both, and billing groups has the attribution rules.

If someone's spend limit and chargeback line seem to disagree, they answer different questions. Regrouping the person in one place won't change the other.