Automate user provisioning with SCIM

SCIM lets your identity provider create and deactivate Cesura users automatically, so you don't manage accounts by hand. When you add a user in your directory (Microsoft Entra ID, Okta), they're provisioned in Cesura; when you deactivate them there, they're deactivated in Cesura too. This guide is for Organization Admins.

Note: SCIM attaches to an SSO connection. Set up an OIDC or SAML connection first (see "Set up OpenID Connect (OIDC) SSO" or "Set up SAML 2.0 SSO"), then enable SCIM on it.

Step 1 — Open the SCIM panel

1. Open Organization Management → Single Sign-On.
2. In the row of the connection you want to provision through, click the expand arrow in the Email domains column.
3. Find the SCIM provisioning section, below the email domains.

Step 2 — Copy the base URL and generate a token

1. Copy the SCIM base URL (Tenant URL) — your IdP needs this as the SCIM endpoint.
2. Click Generate SCIM token.
3. Copy the SCIM bearer token that appears. It is shown only once — copy it now and store it somewhere safe.

Step 3 — Configure provisioning in your IdP

In your IdP's provisioning settings for the Cesura app, paste the SCIM base URL (Tenant URL) as the SCIM endpoint and the SCIM bearer token as the secret token. Then map the user attributes (at minimum email and name) and turn provisioning on.

What syncs

• Users — users created in your directory are provisioned in Cesura; users you deactivate in your directory are deactivated in Cesura. Deactivation is a soft deactivation (the account is made inactive) — SCIM never permanently deletes a Cesura account.
• Groups — Cesura accepts groups synced from your directory, but they aren't shown in Cesura and don't drive access or permissions.

Rotating or revoking the token

• Rotate SCIM token — generates a new token and invalidates the old one. Update your IdP with the new token (it's shown only once).
• Revoke — removes the token and stops provisioning until you generate a new one.

Need a hand? Reach out through Contact support under Get help in the sidebar.