Skip to main content
SCIM (System for Cross-domain Identity Management) lets your identity provider (IdP), such as Okta or Microsoft Entra ID, manage CloudThinker accounts for you. Assign someone to the CloudThinker app in your IdP and they join your organization; unassign them and their access ends, with no manual invites or removals.

​
Prerequisites

  • An organization on the Scale, Scale Plus or Enterprise plan. See Pricing.
  • An active SSO connection with a verified domain. The provisioning settings only appear once SSO is active.
  • The organization Owner role in CloudThinker. Admins can’t manage SSO or SCIM. See Roles and permissions.
  • Admin access to the provisioning settings of your CloudThinker app in your IdP.

​
What SCIM changes in CloudThinker

Unassigning someone from the app usually counts as a deactivation, not a delete. Okta and Microsoft Entra ID both send active=false when you unassign a user, so the person is suspended in CloudThinker, not removed. They’re removed only when your IdP sends a DELETE. While SCIM is on, your IdP is the source of truth for who’s in the organization:
  • Member invitations are turned off. Inviting from CloudThinker returns “Member invitations are disabled because this organization uses SCIM provisioning.”
  • You can’t remove a SCIM-provisioned member in CloudThinker. The error reads “This member was provisioned via SCIM.” Remove them in your IdP instead.
  • Just-in-time provisioning is turned off. SCIM and just-in-time (accounts created on first SSO sign-in) can’t run together. Turning on SCIM switches just-in-time off for you. Someone on your domain whom your IdP hasn’t provisioned is refused at SSO sign-in with “No account found. Contact your administrator for access.” until your IdP provisions them.
You can still change a member’s role or workspace access in CloudThinker. See Organization.

​
Turn on SCIM in CloudThinker

1

Open the provisioning settings

Go to Admin Settings → Identity and access and find the Provisioning & directory sync card under your SSO connection.If the card is missing, your SSO connection isn’t active yet. Finish SSO setup first.
2

Choose SCIM

Select SCIM (Sync users and groups from your identity provider). The other options are Manual (you invite people yourself) and Just-in-time (accounts are created on first SSO sign-in).Success state: the SCIM enabled dialog opens.
3

Copy the two values

The dialog shows:
  • Bearer token: the secret your IdP sends to prove its requests are allowed.
  • SCIM base URL: the endpoint your IdP calls. It looks like https://<your-cloudthinker-host>/api/v1/scim/<organization-id>/v2.
Copy both, then click Done.Success state: the card shows Directory sync (SCIM) with “SCIM directory sync is active.”
The bearer token is shown only once. If you close the dialog without copying it, click Rotate token to get a new one.

​
Set defaults for new members

Below the provisioning options, two settings decide what a newly provisioned person gets. Set them before your IdP sends its first users. Owner can’t be assigned this way. For what each role can do, see Roles and permissions.

​
Configure your identity provider

Use the CloudThinker app you created for SSO.
1

Enable SCIM on the app

Open the CloudThinker app. On the General tab, click Edit under App Settings, set Provisioning to SCIM, and save.
2

Enter the connection details

On Provisioning → Integration, click Edit:Click Test Connector Configuration, then Save.
3

Turn on To App actions

On Provisioning → To App, click Edit and enable Create Users, Update User Attributes and Deactivate Users. Save.
4

Push groups

On the Push Groups tab, add the groups you want to map to workspaces.
CloudThinker reads these attributes: Success state: assign one test user to the app. Within your IdP’s sync interval they appear in Admin Settings → Organization → Members, and View sync logs shows a CREATE entry with status SUCCESS. What CloudThinker’s SCIM API supports, so you can match your IdP’s options:
If someone already has a CloudThinker account from another organization, CloudThinker adds that existing account to yours only when its email domain is one of your verified SSO domains. Otherwise your IdP gets “User email domain not verified for this organization.”

​
Map groups to workspaces

Groups let one IdP change put a whole team into the right workspaces.
1

Push groups from your IdP

In your IdP, assign the groups to the CloudThinker app and push them.Success state: each group shows up under Group mappings on Admin Settings → Identity and access, with its Group name and Members count. Until then the section reads “No groups synced yet.”
2

Pick workspaces for each group

In the group’s row, open Auto-assigned workspaces and select the workspaces its members should join.
3

Choose the group role

Set Auto-assigned organization role for the group, or leave Inherit from connection to use the default role you set above.CloudThinker sets a member’s organization role once, when it creates them. Later syncs don’t change it, so a role you change by hand in CloudThinker stays.
4

Save the row

Click Save in the Actions column.Success state: current members of the group are added to the selected workspaces, and future members are added when your IdP syncs them into the group.
Group mappings only add workspace access. Removing someone from a group, or removing a workspace from a mapping, doesn’t take them out of that workspace. Remove them in workspace members, or unassign them from the app in your IdP to remove them everywhere.
After the first sync, check new members’ roles in Admin Settings → Organization → Members and adjust any that should differ.

​
What happens when someone leaves

Automations never change owner on their own. A workspace Admin can select Take ownership on the automation’s page, and it stays off until they turn it on. See automation owners.
If your plan uses per-seat billing and every seat is taken, a newly provisioned or reactivated person is added as inactive and can’t use CloudThinker yet. Active members and pending invitations use seats; suspended and inactive members don’t. The Owner adds seats on Admin Settings → Billing; see Add or remove seats. Then check their status in Admin Settings → Organization → Members.

​
Rotate or turn off the token

Rotate the token when it may have leaked or your policy requires it:
1

Rotate

In Directory sync (SCIM), click Rotate token, then Rotate in the confirmation.Success state: a dialog shows the new Bearer token and the SCIM base URL. The old token keeps working for 24 hours.
2

Update your IdP

Paste the new token into your IdP’s provisioning settings and test the connection. Do it within 24 hours, or syncs start failing with authentication errors.
Turn off SCIM by choosing Manual or Just-in-time in Provisioning & directory sync, then Disable SCIM in the confirmation. This revokes the token at once and stops directory sync. Existing members keep their accounts, and you manage them in CloudThinker from then on. Turn off provisioning in your IdP too, or it keeps sending requests that fail. Token changes (generate, rotate, revoke) and every user or group that SCIM provisions, updates or removes are recorded in audit logs.

​
Check sync activity

Click View sync logs in Directory sync (SCIM) to open SCIM sync logs. CloudThinker also checks once a day for SCIM-provisioned people with no sync activity for 7 days, and adds an UPDATE entry with status SKIPPED for each one. It’s a reminder only: CloudThinker doesn’t change their access. Check that the person is still assigned in your IdP, and unassign them there if they’ve left.

​
Troubleshooting

The card only shows when your SSO connection is active. Finish SSO setup, including domain verification. You also need the Owner role.
CloudThinker doesn’t pull groups; your IdP has to push them. Assign the groups to the CloudThinker app in your IdP, run a push, then look for Group entries in View sync logs.
Confirm the user is assigned to the CloudThinker app in your IdP, then look for a FAILED entry in the sync logs. Common causes: the token was rotated more than 24 hours ago or revoked, the person’s existing account uses an unverified email domain (“User email domain not verified for this organization”), or the email is reserved for an internal CloudThinker account (“This email belongs to a CloudThinker System user”). For the last one, use a different email or contact support.
Unassign or deactivate them on the CloudThinker app itself. Removing them from a group only changes group membership. Some IdPs sync on a schedule (Microsoft Entra ID runs about every 40 minutes), so wait for the next cycle and check the sync logs.
The token in your IdP is no longer valid: the token was rotated more than 24 hours ago, or SCIM was turned off. Click Rotate token and paste the new value into your IdP. If SCIM was turned off, select SCIM again to get a new token.
Just-in-time and SCIM can’t run together. Choose Just-in-time in Provisioning & directory sync and confirm Disable SCIM, which revokes the token and stops directory sync.
That’s expected while SCIM is on. Assign or unassign people in your IdP instead.

​
Next steps

Roles and permissions

Pick the right default role for provisioned members.

Workspace members

Fine-tune who can open each workspace.

Audit logs

Review token changes and deprovisioning.

Single sign-on

Change your SSO connection or verified domains.