Identity Provisioning (SCIM)

Netgraph can provision accounts and groups automatically from your identity provider using SCIM 2.0 (System for Cross-domain Identity Management), the open standard identity providers use to push identity data. Provisioning sits alongside manual invitation and SAML single sign-on, and an organization can register it twice: once for administrators, where an IdP group becomes a Netgraph Team and its members become administrators, and once for self-service users, where an IdP group becomes a Self-Service Team and its members become identities that can sign in to the Self-Service Portal. When someone is removed or deactivated in the IdP, their access is withdrawn.

At a glance

Standard

SCIM 2.0 (Users and Groups)

Identity providers

Okta, Microsoft Entra ID, and other SCIM 2.0 providers

Provisions

Administrator accounts and groups (groups become Teams); self-service users and groups (groups become Self-Service Teams)

Scope

Administrators: Organization and MSP partner. Self-service users and teams: Organization

Authentication

A bearer API key, issued once per registration

Okta

Microsoft Entra ID

Other SCIM 2.0 provider

SCIM 2.0→users · groups

Netgraph Administrators · Teams · Self-service users · Self-Service Teams

Your identity provider pushes users and groups over SCIM, to the administrator registration or to the self-service registration. In the first, users become administrators and groups become Teams; in the second, users become self-service identities and groups become Self-Service Teams. Roles are never sent over SCIM: an administrator maps each Team to roles in Netgraph, and binds each Self-Service Team to the policy, group, onboarding rule or Site manager role that grants its members access.

What SCIM provisions

SCIM provisions people and groups, not devices (those authenticate through the individual services). An organization has two registrations, each with its own endpoint, API key and activity log.

Administrators, under Admin Access Control:

• A SCIM user becomes an administrator account in the organization or MSP partner, with the default role configured for the integration.
• A SCIM group becomes a Netgraph Team. Membership of the group in the IdP determines the Team’s members.

Self-service users and teams, under Selfservice Access Control › Provisioning:

• A SCIM user becomes a self-service identity: a person who can sign in to the Self-Service Portal through the organization’s self-service single sign-on.
• A SCIM group becomes a Self-Service Team, marked with its SCIM origin and locked for manual editing. Membership follows the IdP group.

SCIM synchronizes membership and naming only. It never assigns roles: an administrator maps each Team to roles once in Netgraph, and binds each Self-Service Team to what grants access (a Sign In Access Policy, an EasyPSK group, an onboarding rule or a Site manager role). That mapping stays under your control regardless of what changes in the IdP. SCIM does not create EasyPSK groups either; an onboarding rule bound to a Self-Service Team gives each member a group of their own at first sign-in. This keeps provisioning (who exists) separate from authorization (what they can do).

Scope

Administrator provisioning is available at Organization and MSP partner scope, with a single registration per scope. Self-service provisioning is available at Organization scope, as a second registration beside the administrator one.

Setup

Administrator provisioning is configured under Provisioning in the Administration Portal:

1. Enable SAML single sign-on first, so provisioned administrators can sign in. See Identity and Authentication.
2. Copy the SCIM endpoint URL shown in Netgraph into your IdP’s SCIM configuration.
3. Generate an API key and paste it into your IdP as the bearer token. The key is shown once. It can be regenerated, which immediately invalidates the previous key, or removed.

Self-service provisioning is configured under Selfservice Access Control › Provisioning in the same way, with its own endpoint URL and API key. Set up the Self-Service Portal’s SAML identity provider first: the registration requires it, since provisioned self-service users sign in through it.

Lifecycle and deprovisioning

Provisioning is continuous.

• Administrators. When a user is deactivated or removed in the IdP, their administrator access is withdrawn at once and they are removed from every Team in that scope, so no team-derived access remains. The administrator list hides a blocked administrator and removes the account after a 30-day window in which a return in the IdP restores it. When an IdP group is deleted, the corresponding Team is removed.
• Self-service users and teams. The identity provider governs the Self-Service Portal. A person who is blocked or deleted in the IdP loses the portal at once: their session ends and they can no longer sign in, by email link or by single sign-on. What the IdP blocked is kept for 30 days, so a return restores it, and is removed after that. A change of a person’s user name in the IdP moves everything to the new address. When an IdP group is deleted, the Self-Service Team is removed and its members lose what the team gave, at once.

Related sections

• Teams: how provisioned groups grant access, and the difference between Teams and Self-Service Teams.
• Identity and Authentication: the SAML single sign-on that provisioned administrators and self-service users sign in with.
• Roles and Administration Levels: the roles a Team can hold.
• Self-Service Portal: the surface self-service users are provisioned into.