Skip to content
Support
Setup

Set up SCIM provisioning

Connect your identity provider (Okta, Microsoft Entra ID) to provision administrators and groups into your Organization automatically over SCIM 2.0. Users become administrators, groups become Teams.

SCIM provisioning lets your identity provider create, update, and deactivate administrators in your Organization automatically. When you add someone to the right group in Okta or Microsoft Entra ID, they appear as an administrator in Netgraph; the IdP group becomes a Team; and when they leave the group or are deactivated, their access is withdrawn. No invitations to send by hand.

It lives at Admin Access Control → Provisioning in the Organization left navigation.

The Provisioning page with a User provisioning and Group sync card and a Configure button on the SCIM row
Provisioning — the User provisioning & Group sync card. Click Configure on the SCIM row to start.

What SCIM syncs

Section titled “What SCIM syncs”
  • A user in your IdP becomes an administrator in your Organization, with the default role you choose.
  • A group in your IdP becomes a Team (see Organizing administrators in Teams). The group’s membership becomes the Team’s membership.

SCIM keeps membership and names in step. It never assigns roles — you map each Team to roles yourself, and that stays under your control no matter what changes in the IdP.

Enable SAML single sign-on first

Provisioned administrators sign in with SAML, so configure [Admin Portal authentication](/wiki/organization/setup/admin-authentication/) before you connect SCIM. A provisioned user with no way to sign in can't do anything.

Connect your identity provider

Section titled “Connect your identity provider”

Open Provisioning → SCIM → Configure. The screen gives you the two values your IdP needs.

  1. Copy the SCIM endpoint URL

    Copy the SCIM endpoint URL shown on the page into your IdP’s SCIM (provisioning) configuration. This is the address your IdP pushes users and groups to.

  2. Generate an API key

    Click Generate API key. The key is shown once — copy it immediately and paste it into your IdP as the bearer token, then close the dialog.

  3. Turn on provisioning in your IdP

    In Okta, Microsoft Entra ID, or your other provider, enable SCIM provisioning for the application and assign the users and groups you want managed. They begin appearing in Netgraph as administrators and Teams.

The SCIM configuration screen with the How to setup SCIM steps, the SCIM endpoint URL field, and the Generate API key button
The SCIM screen: the setup steps, the SCIM endpoint URL to copy, and Generate API key.

The API key is shown once

Netgraph keeps only a hash of the key and can't show it again. If you lose it, use **Regenerate API key** — the previous key stops working immediately, so update your IdP with the new one. **Remove configuration** revokes the key and stops provisioning entirely.

Keeping access in step

Section titled “Keeping access in step”

Provisioning runs continuously:

  • Add a user to the IdP group, and they become an administrator.
  • Remove or deactivate them, and their administrator access is withdrawn and they leave every Team in the Organization.
  • Delete the IdP group, and the matching Team is removed.
Section titled “Related pages”

Next

Managing Administrators

The Administrators page lists every person who can sign in to your Organization's Admin Portal, the role they hold, when they joined, whether they have MFA on, and how they were provisioned. Day-to-day work — invite, edit, resend, remove — happens here.

Organizing administrators in Teams

A Team is a named group of administrators. Grant roles to the Team once and every member inherits them, with different roles per Service Context. Create teams, add members, and grant access.