--- title: "SCIM provisioning" slug: "scim-provisioning" description: "Automate user management in Document360 with SCIM, syncing identities seamlessly across applications for secure and efficient access control." updated: 2026-07-14T10:33:21Z published: 2026-07-14T10:33:47Z canonical: "docs.document360.com/scim-provisioning" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # SCIM provisioning **SCIM (System for Cross-domain Identity Management)** is an open standard protocol that automates how user identities are created, updated, and removed across different applications. When integrated with Document360, SCIM allows your Identity Provider to automatically sync users, readers, and groups — eliminating the need for manual account management. --- ## How SCIM simplifies user management In most organizations, managing user access across multiple platforms is time-consuming and error-prone. Administrators have to manually add new employees and remember to remove access when someone leaves. SCIM eliminates all of this. With SCIM enabled in Document360, your Identity Provider handles this automatically. Any change you make in your IdP syncs to Document360 right away. - When a new employee joins, simply add them to your IdP and their account is automatically created across all connected applications, including Document360. - When someone leaves the organization, their access across all connected applications, including Document360, is revoked automatically. This keeps your user access accurate, secure, and always up to date, without any extra effort from your administrators. ![Flowchart illustrating user provisioning, enforcement, and updates in a system process.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/scim article(1).png) Depending on your IdP, SCIM provisioning in Document360 lets you manage the following directly from your IdP: - **Users** — Automatically provision and manage users in Document360. - **Reviewers** — Provision reviewer accounts directly using the `userType` attribute. - **Readers** — Provision reader accounts and control their content access. - **Groups** — Create and sync user and reader groups for streamlined permission management. --- ## How SCIM determines user roles SCIM uses the `userType` attribute to determine the role assigned to a person when they are provisioned in Document360: **User**, **Reviewer**, or **Reader**. | `userType` value | Role in Document360 | | --- | --- | | `user` | Provisioned as a **User** | | `reviewer` | Provisioned as a **Reviewer** | | `reader` | Provisioned as a **Reader** | - `userType` → **String** attribute - `isTeamAccount` → **Boolean** attribute (legacy) Both attributes are defined in the same extension namespace: `urn:ietf:params:scim:schemas:extension:document360:2.0:User`. ### Legacy attribute: `isTeamAccount` Before `userType` was introduced, roles were determined using the `isTeamAccount` boolean attribute. It supports only two roles: | `isTeamAccount` | Role in Document360 | | --- | --- | | `True` | Provisioned as a **User** | | `False` | Provisioned as a **Reader** | The `isTeamAccount` attribute continues to be supported, so existing attribute mappings will keep working without any changes. Migrating to `userType` is not required — but only `userType` can provision the **Reviewer** role. If you want to provision Reviewers, update your attribute mapping to use `userType`. ### Attribute precedence Either `userType` or `isTeamAccount` attribute is configured in your Identity Provider as part of the attribute mapping setup. You can set it manually for each user, or use your IdP's [Expression Builder](https://docs.document360.com/docs/scim-with-okta#use-expression-builder-to-map-roles) to assign it automatically based on an existing attribute, such as Job Title or Group membership. NOTE For step-by-step instructions on configuring profile attribute statements in Okta, see [Assign Profile attribute statements](https://docs.document360.com/docs/saml-sso-with-okta#assign-profile-attribute-statements). --- ## SCIM capabilities by provider SCIM provisioning in Document360 is set up as part of your SSO configuration. The capabilities available depend on your Identity Provider. | Identity Provider | Protocol | Users | Readers | Groups | | --- | --- | --- | --- | --- | | Okta | SAML | Yes | Yes | Yes | | Microsoft Entra | SAML | Yes | Yes | Yes | | OneLogin | SAML | No | Yes | No | | ADFS | SAML | Yes (via third-party tools) | Yes (via third-party tools) | Yes (via third-party tools) | | Okta | OpenID Connect | Yes | Yes | Yes | | ADFS | OpenID Connect | Yes (via third-party tools) | Yes (via third-party tools) | Yes (via third-party tools) | | Other providers | SAML / OpenID Connect | Yes (if IdP supports SCIM) | Yes (if IdP supports SCIM) | Yes (if IdP supports SCIM) | --- ## Configure SCIM with your Identity Provider Select your Identity Provider below to get started. ### SAML Okta Automate user, reader, and group lifecycle management between Okta and Document360 using SAML and SCIM. [SCIM with Okta →](https://docs.document360.com/docs/scim-with-okta) Microsoft Entra Automate user, reader, and group lifecycle management between Microsoft Entra and Document360 using SAML and SCIM. [SCIM with Entra →](https://docs.document360.com/docs/scim-with-entra) OneLogin Provision readers from OneLogin to Document360 using SAML and SCIM. Note: user and group provisioning is not supported. [SCIM with OneLogin →](https://docs.document360.com/docs/saml-sso-with-onelogin#scim-provisioning) ADFS Configure SCIM provisioning with ADFS using third-party tools. [SCIM with ADFS →](https://docs.document360.com/docs/saml-sso-with-adfs#scim-provisioning) Other configurations Configure SCIM provisioning with any SAML 2.0-compatible Identity Provider that supports SCIM. [SCIM with other providers →](https://docs.document360.com/docs/saml-sso-with-other-configurations#scim-provisioning) ### OpenID Connect Okta OpenID Configure SCIM provisioning with Okta using OpenID Connect. [SCIM with Okta OpenID →](https://docs.document360.com/docs/okta-with-openid-sso#scim-provisioning) Auth0 OpenID Configure SCIM provisioning with Auth0 using OpenID Connect. [SCIM with Auth0 OpenID →](https://docs.document360.com/docs/auth0-with-openid-sso#scim-provisioning) ADFS OpenID Configure SCIM provisioning with ADFS using OpenID Connect. [SCIM with ADFS OpenID →](https://docs.document360.com/docs/adfs-with-openid-sso#scim-provisioning) Other configurations OpenID Configure SCIM provisioning with any OpenID Connect-compatible Identity Provider that supports SCIM. [SCIM with other OpenID providers →](https://docs.document360.com/docs/other-configurations-with-openid-sso#scim-provisioning)