SCIM Provisioning
Last updated on August 14, 2026
SCIM provisioning pushes member changes from your identity provider to TofuPilot: add a user to a linked group in Okta and they get a TofuPilot account, remove them and their access is revoked.
SCIM runs on top of SSO: SSO handles authentication, SCIM handles lifecycle. SSO works without SCIM, but SCIM requires SSO. Configuring SCIM requires the Owner role.
What SCIM syncs
| Event in your directory | Effect in TofuPilot |
|---|---|
| User created in linked group | New member, default role from group mapping |
| User removed from group | Member removed from organization |
| User attributes updated (name, email) | Profile updated |
| User suspended | Sign-in blocked until reactivated in the directory |
| Group renamed or remapped | Access group membership updated |
Role assignment comes from group mapping, so you can map directory group Engineering to role Developer and group Operators to role Operator.
Configure SCIM
Set up SSO first.
Open Settings > Organization > SCIM Provisioning.
Click Generate token and copy the bearer token and base URL.
In your identity provider, create a SCIM 2.0 provisioning connection for TofuPilot, then paste the base URL and bearer token.
Map directory groups to TofuPilot roles.
Enable provisioning in your identity provider.
The first sync runs immediately, and subsequent syncs are incremental.
Verify the sync
Add a test user to a mapped group: the user appears in Settings > Members within a minute with the role mapped to their group. Remove the test user from all mapped groups: their membership is removed within a minute.
Rotate the SCIM token
Open Settings > Organization > SCIM Provisioning.
Click Rotate token.
Paste the new token into your identity provider's SCIM connection.
The old token is revoked as soon as the new one is generated.
Limitations
SCIM controls organization membership and roles, but it does not control access group membership. For access group assignment, use the access groups UI or the API.
The Owner role cannot be assigned via SCIM, so you have to transfer ownership manually in Settings > Organization.
How is this guide?
Single Sign-On
Learn how to authenticate every TofuPilot member through your identity provider with SAML 2.0 or OIDC, so credentials never live on TofuPilot.
Two-Factor Authentication
Learn how to strengthen TofuPilot sign-in with a second factor, using passkeys or authenticator-app one-time codes, and how to enforce it org-wide.