Skip to main content
SCIM (System for Cross-domain Identity Management) directory sync lets your identity provider automatically add, update, and remove CloudThinker users and groups as your company directory changes. It is available on Scale, Scale+, and Enterprise plans and requires an active SSO connection.

​
Prerequisites

  • An active SSO connection with a verified domain — see Single Sign-On
  • Organization Owner access in CloudThinker
  • Admin access to your identity provider’s provisioning settings

​
How SCIM works in CloudThinker

Your identity provider (IdP) calls CloudThinker’s SCIM 2.0 API with a bearer token — a secret that authorizes its requests — whenever your directory changes:
  • Users assigned to the CloudThinker application in your IdP are added to your organization
  • Users removed from the application are deactivated in CloudThinker
  • Groups pushed from your IdP appear in CloudThinker and can be mapped to workspaces and roles
  • Group membership changes update workspace access automatically

​
Enable SCIM in CloudThinker

1

Open Identity and access

Go to Admin Settings → Identity and access. The Provisioning & directory sync card appears below the SSO card when your SSO connection is active.
2

Select SCIM

Select the SCIM provisioning mode. CloudThinker generates a bearer token and a SCIM endpoint URL.
3

Copy your credentials

A dialog shows the two values your identity provider needs:
  • Bearer token — authenticates your IdP against CloudThinker’s SCIM API
  • SCIM base URL — the endpoint your IdP sends requests to (format: https://<your-domain>/api/v1/scim/{org_id}/v2)
Success state: both values are copied — the bearer token is shown only once.
Copy the bearer token before closing the dialog — it cannot be retrieved later. If you lose it, rotate the token.

​
Configure your identity provider

In your IdP’s provisioning settings for the CloudThinker application (Okta, Microsoft Entra, OneLogin, and others use the same values): Supported operations:
CloudThinker supports filtering by userName for user lookups and displayName for group lookups. Bulk operations are not supported.

​
Map groups to workspaces and roles

Groups your IdP pushes appear automatically in the Group mappings section on the Identity and access page.
1

Wait for groups to appear

Assign groups to the CloudThinker application in your IdP. They show up in the Group mappings table once pushed — timing depends on your IdP’s sync interval.
2

Choose workspaces

For each group, select which workspaces its members are automatically added to.
3

Set a role (optional)

Choose an organization role per group — Viewer, Developer, or Admin — or leave Use connection role to apply the default role from your SSO connection settings.
4

Save

Click Save on each group row.Success state: members of the group get the mapped workspaces and role on their next sync.

​
Manage the SCIM token

Rotate — in the Directory sync (SCIM) section, click Rotate token and confirm. The old token stays valid for 24 more hours, so update your IdP within that window and no sync fails during the switch. Revoke — switching the provisioning mode away from SCIM (to Manual or Just-in-time) revokes the token immediately and stops all directory sync.

​
Monitor sync activity

Click View sync logs in the Directory sync section to see every SCIM operation:

​
Troubleshooting

CloudThinker doesn’t pull groups — your IdP must push them. Confirm groups are assigned to the CloudThinker application in your IdP’s provisioning settings, then check View sync logs for group sync attempts.
Verify the user is assigned to the CloudThinker application in your IdP, and that the token hasn’t been rotated or revoked. Look for FAILED entries in the sync logs — they include failure details. Also confirm the email isn’t already tied to a different CloudThinker organization.
The user must be unassigned from the application itself — removing them from a group alone isn’t enough. Some IdPs sync on a cycle (Microsoft Entra syncs roughly every 40 minutes); wait for the next cycle and re-check the sync logs.
Another admin may have rotated or revoked it. Rotate the token in CloudThinker and update your IdP with the new value.
Just-in-time provisioning and SCIM can’t run at the same time. Switch the provisioning mode to Manual or Just-in-time first — this revokes the SCIM token and stops directory sync, and your IdP will start receiving authentication errors until you disable provisioning there too. Existing users keep their accounts.

Single Sign-On

Domain verification, connection setup, and enforcement — the prerequisite for SCIM

Security Overview

MFA, roles and permissions, and audit logs

Organization Management

Manage organization members and roles

Workspace Users

Workspace-level access control