What is SCIM Provisioning?

Without SCIM, adding or removing an employee from every connected application requires manual admin work in each tool separately, which is slow and error-prone — especially for deactivation, where a delayed offboarding leaves a departed employee's access live. SCIM defines a standard REST API and JSON schema so an identity provider (Okta, Azure AD, Google Workspace) can push user and group changes to any SCIM-compliant application automatically. The core operations are create, update, and deactivate/delete, triggered the moment the identity provider's directory changes — a new hire added to a group gets provisioned into every SCIM-connected app within minutes, and an offboarded employee loses access everywhere in the same push, rather than depending on someone remembering to revoke it tool by tool. SCIM is a common enterprise-security and SOC 2 requirement precisely because it closes the gap between "someone left the company" and "their access was actually revoked," turning a manual, auditable-by-exception process into an automatic, centrally-controlled one.