Skip to lesson
Exit
Identity & Access Deep Dive1 / 2

1 min lesson

SCIM provisioning & deprovisioning

Answer this as if it were happening now: "On offboarding via SCIM, what's the correct operation and why not delete?" Say what supports your choice.

Step 1 of 2

SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. is the difference between offboarding that happens in seconds and offboarding that sits in a ticket queue for three days while a departed employee still has live access. The deprovisioning half is where IT security actually lives.

SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. 2.0 is a standardized REST schema for synchronizing users and groups between an IdP and downstream apps. The IdP is the source; it pushes create, update and deactivate events to each app's SCIM endpoint as identities change. It's the engine behind "auto-provisioning" in Okta and Entra.

SCIM operation
Create user
HTTP
POST /Users
Lifecycle meaning
Joiner - account spun up in the app on assignment
SCIM operation
Update / replace
HTTP
PUT or PATCH /Users/{id}
Lifecycle meaning
Mover - attribute or group change recalculated downstream
SCIM operation
Deactivate
HTTP
PATCH active:false
Lifecycle meaning
Leaver - access cut without deleting history (audit-safe)
SCIM operation
Group membership
HTTP
PATCH /Groups/{id}
Lifecycle meaning
Push/pull membership so app roles track IdP groups

PATCH active:false is the offboarding workhorse - disable, don't delete.