1 min lesson
SCIM provisioning & deprovisioning
Answer this as if it were happening now: "On offboarding via SCIM, what's the correct operation and why not delete?" Say what supports your choice.
Step 1 of 2
SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. is the difference between offboarding that happens in seconds and offboarding that sits in a ticket queue for three days while a departed employee still has live access. The deprovisioning half is where IT security actually lives.
SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. 2.0 is a standardized REST schema for synchronizing users and groups between an IdP and downstream apps. The IdP is the source; it pushes create, update and deactivate events to each app's SCIM endpoint as identities change. It's the engine behind "auto-provisioning" in Okta and Entra.
- SCIM operation
- Create user
- HTTP
- POST /Users
- Lifecycle meaning
- Joiner - account spun up in the app on assignment
- SCIM operation
- Update / replace
- HTTP
- PUT or PATCH /Users/{id}
- Lifecycle meaning
- Mover - attribute or group change recalculated downstream
- SCIM operation
- Deactivate
- HTTP
- PATCH active:false
- Lifecycle meaning
- Leaver - access cut without deleting history (audit-safe)
- SCIM operation
- Group membership
- HTTP
- PATCH /Groups/{id}
- Lifecycle meaning
- Push/pull membership so app roles track IdP groups
| SCIM operation | HTTP | Lifecycle meaning |
|---|---|---|
| Create user | POST /Users | Joiner - account spun up in the app on assignment |
| Update / replace | PUT or PATCH /Users/{id} | Mover - attribute or group change recalculated downstream |
| Deactivate | PATCH active:false | Leaver - access cut without deleting history (audit-safe) |
| Group membership | PATCH /Groups/{id} | Push/pull membership so app roles track IdP groups |
PATCH active:false is the offboarding workhorse - disable, don't delete.