Setting Up SCIM Provisioning

SCIM lets your identity provider (IdP) create, update, and deactivate Lavalier users automatically, so you don't have to manage accounts by hand. SCIM works alongside single sign-on and is set up by an account Owner on the same settings page.

Before You Start

• Owner permissions in Lavalier.
• SAML SSO already set up and enabled. SCIM builds on your SSO configuration—see Setting Up Single Sign-On first.
• A SCIM 2.0-capable identity provider, such as Okta or Microsoft Entra.
  
  

Step 1: Enable SCIM

1. Go to Settings → SSO & Provisioning.

2. Scroll to the SCIM provisioning section. (It appears once your SAML configuration exists.)

3. Turn on Enable SCIM.

Note: The Enable SCIM toggle stays locked until SSO is on—if it's disabled, you'll see "Enable SAML SSO above to turn on SCIM." Finish enabling SSO first.

Step 2: Copy Your SCIM Connection Details

Once SCIM is enabled, Lavalier reveals two values to paste into your IdP:

1. SCIM base URL — paste this into your identity provider's SCIM configuration.

2. Unique identifier field for users — this is userName. Enter it in your identity provider's SCIM user settings.
   
   

Step 3: Create a SCIM Token

Your IdP authenticates its sync requests with a bearer token.

1. In the SCIM provisioning section, click Create token.

2. Give the token a name so you can recognize it later—for example, the IdP it belongs to (e.g., Okta production).

3. Click Create, then copy the token.

Note: This is the only time you'll see the token. Copy it now and store it securely—Lavalier can't retrieve it again. If you lose it, revoke it and create a new one.

Step 4: Finish Setup in Your Identity Provider

In your IdP's provisioning settings for Lavalier:

1. Paste the SCIM base URL.

2. Paste the token as the bearer/secret token.

3. Set the unique identifier field to userName.

4. Run your IdP's test/connection check, then assign the users or groups you want to provision.
   
   

What SCIM Keeps in Sync

Once connected, your IdP manages Lavalier accounts automatically:

• Create — Assigning a user in your IdP provisions their Lavalier account. Their email domain must be a verified domain on your account, and they're created with your account's default role (never Owner).
• Update — Changes to first name, last name, and active status flow through automatically.
• Deactivate — Setting a user to inactive in your IdP disconnects them from your Lavalier account.
• Remove — Deprovisioning a user removes their access and signs them out. If they belong to no other Lavalier account, their user record is removed.

Note: Account Owners are protected. SCIM can't deactivate or remove an owner—restore or change an owner from within Lavalier instead.

Managing Tokens

• The token list shows your active tokens, each with a masked preview and when it was last used.
• Revoke a token to cut off its access immediately—any IdP using it stops syncing until you create and configure a new one.
• You can keep more than one token active (up to three) so you can rotate tokens without downtime.
  
  

What's next?

• Setting Up Single Sign-On — Configure the SAML SSO that SCIM builds on
• Inviting Users and Managing Permissions — Manage roles and access
  
  

Troubleshooting