SCIM provisioning

Connect your provider

1. Open Workspace settings → Sign-in → Advanced sign-in → SCIM 2.0 provisioning.
2. Issue a token and copy it immediately; Embrasure stores only its hash.
3. Copy the displayed workspace base URL into your provider's SCIM 2.0 connector and use the token as its HTTP bearer secret.
4. Provision a viewer, test a role update, then deactivate that test user before broad assignment. Never test deactivation with the workspace owner.

Users and Groups support create, read, replace, patch, delete, and membership updates. Use userName (normally work email) for user identity and displayName for groups.

Roles and offboarding

Map each User's roles attribute to admin, security_admin, billing_admin, editor, or viewer. Unsupported or unmapped values become viewer. Groups synchronize as governance principals; workspace roles belong to User resources. SCIM cannot grant or deactivate the owner role.

Setting active to false removes non-owner membership and revokes active agent sessions, personal API tokens, and per-user connector credentials. Deletion cuts off the same access and retains a disabled directory record for audit continuity.

Keep one provisioning token per provider connection. Rotation in Workspace settings replaces and immediately revokes the previous token.

Troubleshooting

• 401: token missing, malformed, invalid, expired, or revoked.
• 403: valid token used for a different workspace. Check the exact base URL.
• Check the token's Last used timestamp to confirm requests arrived.
• SCIM errors use the standard SCIM Error response, with scimType for invalid filters, paths, or values.