---
title: "SCIM provisioning"
slug: "scim-provisioning"
description: "Automate user management in Document360 with SCIM, syncing identities seamlessly across applications for secure and efficient access control."
updated: 2026-07-14T10:33:21Z
published: 2026-07-14T10:33:47Z
canonical: "docs.document360.com/scim-provisioning"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning

**SCIM (System for Cross-domain Identity Management)** is an open standard protocol that automates how user identities are created, updated, and removed across different applications. When integrated with Document360, SCIM allows your Identity Provider to automatically sync users, readers, and groups — eliminating the need for manual account management.

---

## How SCIM simplifies user management

In most organizations, managing user access across multiple platforms is time-consuming and error-prone. Administrators have to manually add new employees and remember to remove access when someone leaves. SCIM eliminates all of this.

With SCIM enabled in Document360, your Identity Provider handles this automatically. Any change you make in your IdP syncs to Document360 right away.

- When a new employee joins, simply add them to your IdP and their account is automatically created across all connected applications, including Document360.
- When someone leaves the organization, their access across all connected applications, including Document360, is revoked automatically.

This keeps your user access accurate, secure, and always up to date, without any extra effort from your administrators.

<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/scim article(1).png" class="article_image" alt="Flowchart illustrating user provisioning, enforcement, and updates in a system process.">
</div>

Depending on your IdP, SCIM provisioning in Document360 lets you manage the following directly from your IdP:

- **Users** — Automatically provision and manage users in Document360.
- **Reviewers** — Provision reviewer accounts directly using the `userType` attribute.
- **Readers** — Provision reader accounts and control their content access.
- **Groups** — Create and sync user and reader groups for streamlined permission management.

---

## How SCIM determines user roles

SCIM uses the `userType` attribute to determine the role assigned to a person when they are provisioned in Document360: **User**, **Reviewer**, or **Reader**.

| `userType` value | Role in Document360 |
|---|---|
| `user` | Provisioned as a **User** |
| `reviewer` | Provisioned as a **Reviewer** |
| `reader` | Provisioned as a **Reader** |

* `userType` → **String** attribute
* `isTeamAccount` → **Boolean** attribute (legacy)

Both attributes are defined in the same extension namespace: `urn:ietf:params:scim:schemas:extension:document360:2.0:User`.

### Legacy attribute: `isTeamAccount`

Before `userType` was introduced, roles were determined using the `isTeamAccount` boolean attribute. It supports only two roles:

| `isTeamAccount` | Role in Document360 |
|---|---|
| `True` | Provisioned as a **User** |
| `False` | Provisioned as a **Reader** |

The `isTeamAccount` attribute continues to be supported, so existing attribute mappings will keep working without any changes. Migrating to `userType` is not required — but only `userType` can provision the **Reviewer** role. If you want to provision Reviewers, update your attribute mapping to use `userType`.

### Attribute precedence

Either `userType` or `isTeamAccount` attribute is configured in your Identity Provider as part of the attribute mapping setup. You can set it manually for each user, or use your IdP's [Expression Builder](https://docs.document360.com/docs/scim-with-okta#use-expression-builder-to-map-roles){target=`_blank`} to assign it automatically based on an existing attribute, such as Job Title or Group membership.

:::(Info) (<p class="fa-regular fa-circle-exclamation"></p> NOTE)
For step-by-step instructions on configuring profile attribute statements in Okta, see [Assign Profile attribute statements](https://docs.document360.com/docs/saml-sso-with-okta#assign-profile-attribute-statements){target="_blank"}.
:::

---

## SCIM capabilities by provider

SCIM provisioning in Document360 is set up as part of your SSO configuration. The capabilities available depend on your Identity Provider.

| Identity Provider | Protocol | Users | Readers | Groups |
|---|---|---|---|---|
| Okta | SAML | Yes | Yes | Yes |
| Microsoft Entra | SAML | Yes | Yes | Yes |
| OneLogin | SAML | No | Yes | No |
| ADFS | SAML | Yes (via third-party tools) | Yes (via third-party tools) | Yes (via third-party tools) |
| Okta | OpenID Connect | Yes | Yes | Yes |
| ADFS | OpenID Connect | Yes (via third-party tools) | Yes (via third-party tools) | Yes (via third-party tools) |
| Other providers | SAML / OpenID Connect | Yes (if IdP supports SCIM) | Yes (if IdP supports SCIM) | Yes (if IdP supports SCIM) |

---

## Configure SCIM with your Identity Provider

Select your Identity Provider below to get started.

### SAML

<div class="doc360-card-row">
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">Okta</p>
    </div>
    <p class="doc360-card__desc">Automate user, reader, and group lifecycle management between Okta and Document360 using SAML and SCIM.</p>
    <a href="https://docs.document360.com/docs/scim-with-okta" target="_blank" class="doc360-card__link">SCIM with Okta →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">Microsoft Entra</p>
    </div>
    <p class="doc360-card__desc">Automate user, reader, and group lifecycle management between Microsoft Entra and Document360 using SAML and SCIM.</p>
    <a href="https://docs.document360.com/docs/scim-with-entra" target="_blank" class="doc360-card__link">SCIM with Entra →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">OneLogin</p>
    </div>
    <p class="doc360-card__desc">Provision readers from OneLogin to Document360 using SAML and SCIM. Note: user and group provisioning is not supported.</p>
    <a href="https://docs.document360.com/docs/saml-sso-with-onelogin#scim-provisioning" target="_blank" class="doc360-card__link">SCIM with OneLogin →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">ADFS</p>
    </div>
    <p class="doc360-card__desc">Configure SCIM provisioning with ADFS using third-party tools.</p>
    <a href="https://docs.document360.com/docs/saml-sso-with-adfs#scim-provisioning" target="_blank" class="doc360-card__link">SCIM with ADFS →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">Other configurations</p>
    </div>
    <p class="doc360-card__desc">Configure SCIM provisioning with any SAML 2.0-compatible Identity Provider that supports SCIM.</p>
    <a href="https://docs.document360.com/docs/saml-sso-with-other-configurations#scim-provisioning" target="_blank" class="doc360-card__link">SCIM with other providers →</a>
  </div>
</div>

### OpenID Connect

<div class="doc360-card-row">
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">Okta OpenID</p>
    </div>
    <p class="doc360-card__desc">Configure SCIM provisioning with Okta using OpenID Connect.</p>
    <a href="https://docs.document360.com/docs/okta-with-openid-sso#scim-provisioning" target="_blank" class="doc360-card__link">SCIM with Okta OpenID →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">Auth0 OpenID</p>
    </div>
    <p class="doc360-card__desc">Configure SCIM provisioning with Auth0 using OpenID Connect.</p>
    <a href="https://docs.document360.com/docs/auth0-with-openid-sso#scim-provisioning" target="_blank" class="doc360-card__link">SCIM with Auth0 OpenID →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">ADFS OpenID</p>
    </div>
    <p class="doc360-card__desc">Configure SCIM provisioning with ADFS using OpenID Connect.</p>
    <a href="https://docs.document360.com/docs/adfs-with-openid-sso#scim-provisioning" target="_blank" class="doc360-card__link">SCIM with ADFS OpenID →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">Other configurations OpenID</p>
    </div>
    <p class="doc360-card__desc">Configure SCIM provisioning with any OpenID Connect-compatible Identity Provider that supports SCIM.</p>
    <a href="https://docs.document360.com/docs/other-configurations-with-openid-sso#scim-provisioning" target="_blank" class="doc360-card__link">SCIM with other OpenID providers →</a>
  </div>
</div>