SCIM provisioning
SCIM provisioning
SCIM keeps Blueprintr membership in step with your identity provider,
including deactivating people who leave. Configuring it needs scim.manage.
SCIM and SSO
SSO controls authentication. SCIM controls membership. Without it, a person removed from your directory keeps their Blueprintr membership until an admin removes it by hand, and the seat stays billed.
If you implement only one of SSO and SCIM and your concern is leavers, implement SCIM.
How it flows
There is no inbound public SCIM endpoint on Blueprintr. Your IdP pushes SCIM 2.0 to the SSO service, which normalises and stores it; Blueprintr then pulls that directory state and projects it onto memberships and roles.
- The SCIM base URL and bearer token you configure in your IdP belong to the SSO service rather than to a Blueprintr API.
- Changes land when a reconcile pass runs, not the instant your IdP sends them. Real-time push is a future enhancement.
Each reconcile applies the cumulative effect of every event since the last one and diffs directory state against local state, so it doubles as drift detection. The delta is audited.
What is enforced
| Membership | Created on first sight |
| Deactivation | An IdP deactivate suspends or removes the member |
What is not enforced
Group-to-role mapping is additive and one-way:
Removing someone from a directory group does not remove the Blueprintr role it granted. SCIM never downgrades a role automatically, and never assigns organisation owner.
One-way mapping stops SCIM undoing a role an admin granted by hand, and stops a mis-scoped IdP group locking an organisation out of its own tenancy.
Drift in the unenforced direction is reported in the run summary rather than acted on. Read those summaries: a role someone should no longer hold shows up there.
If directory groups are unavailable during a run, membership still reconciles and group-to-role sync is skipped for that pass. The summary says so.
Setting it up
Configure the directory in Organisation settings → Enterprise → SCIM. The page is unavailable unless enterprise SSO is enabled for the deployment and the SSO service is reachable. A greyed-out page is a platform prerequisite rather than a permission problem.
The token is shown once. Store it in your IdP immediately. Regenerating invalidates the old one.
Auditing
Every SCIM operation writes an audit entry under its own action: configure, provision, deprovision, reconcile, rotate, toggle and delete. A membership that changed because of your directory is distinguishable from one an admin changed by hand.