# SCIM provisioning

> Directory-driven membership, what it enforces, and the one-way group-to-role mapping.

SCIM keeps Blueprintr membership in step with your identity provider,
including deactivating people who leave. Configuring it needs `scim.manage`.

## SCIM and SSO

SSO controls authentication. SCIM controls **membership**. Without it, a person
removed from your directory keeps their Blueprintr membership until an admin
removes it by hand, and the seat stays billed.

> [!IMPORTANT]
> If you implement only one of SSO and SCIM and your concern is leavers,
> implement SCIM.

## How it flows

There is **no inbound public SCIM endpoint on Blueprintr**. Your IdP pushes
SCIM 2.0 to the SSO service, which normalises and stores it; Blueprintr then
*pulls* that directory state and projects it onto memberships and roles.

![blueprint:josh/how-scim-reaches-blueprintr](https://blueprintr.io/embed/josh/how-scim-reaches-blueprintr#h=520)

- The SCIM base URL and bearer token you configure in your IdP belong to the
  **SSO service** rather than to a Blueprintr API.
- Changes land when a **reconcile pass** runs, not the instant your IdP sends
  them. Real-time push is a future enhancement.

Each reconcile applies the cumulative effect of every event since the last one
*and* diffs directory state against local state, so it doubles as drift
detection. The delta is audited.

## What is enforced

| | |
| --- | --- |
| Membership | Created on first sight |
| Deactivation | An IdP deactivate suspends or removes the member |

## What is not enforced

Group-to-role mapping is **additive and one-way**:

> [!IMPORTANT]
> Removing someone from a directory group does **not** remove the Blueprintr
> role it granted. SCIM never downgrades a role automatically, and never
> assigns organisation **owner**.

One-way mapping stops SCIM undoing a role an admin granted by hand, and stops
a mis-scoped IdP group locking an organisation out of its own tenancy.

Drift in the unenforced direction is **reported in the run summary** rather
than acted on. Read those summaries: a role someone should no longer hold
shows up there.

> [!NOTE]
> If directory groups are unavailable during a run, membership still
> reconciles and group-to-role sync is skipped for that pass. The summary says
> so.

## Setting it up

Configure the directory in **Organisation settings → Enterprise → SCIM**. The
page is unavailable unless enterprise SSO is enabled for the deployment and the
SSO service is reachable. A greyed-out page is a platform prerequisite rather
than a permission problem.

The token is shown once. Store it in your IdP immediately. Regenerating
invalidates the old one.

## Auditing

Every SCIM operation writes an [audit](/foliums/blueprintr-user-guide/teams/audit-log)
entry under its own action: configure, provision, deprovision, reconcile,
rotate, toggle and delete. A membership that changed because of your directory
is distinguishable from one an admin changed by hand.