How SCIM works in CloudThinker
SCIM (System for Cross-domain Identity Management) is an industry standard that lets your identity provider automatically keep CloudThinker in sync with your company directory. Instead of manually inviting and removing users, your IdP handles it for you. When SCIM is enabled:- Users assigned to your CloudThinker application in your IdP are automatically added to your organization
- Users removed from your IdP application are automatically deactivated in CloudThinker
- Groups pushed from your IdP appear in CloudThinker and can be mapped to specific workspaces and roles
- Group membership changes in your IdP automatically update workspace access in CloudThinker
Step 1: Enable SCIM in CloudThinker
Navigate to Identity and access settings
Go to Admin Settings → Identity and access. The Provisioning & directory sync card appears below the SSO card when your SSO connection is active.
Select SCIM
Click the SCIM option in the provisioning mode selector. CloudThinker generates a bearer token and a SCIM endpoint URL.
Copy your credentials
A dialog appears with two values you’ll need to paste into your identity provider:
- Bearer token — the secret token your IdP uses to authenticate with CloudThinker’s SCIM API
- SCIM base URL — the endpoint your IdP will send requests to (format:
https://<your-domain>/api/v1/scim/{org_id}/v2)
Step 2: Configure SCIM in your identity provider
Now switch to your identity provider’s admin console and set up SCIM provisioning for your CloudThinker application. The exact steps vary by provider (Okta, Azure AD / Microsoft Entra, OneLogin, etc.), but the values you need are the same.General configuration
In your IdP’s SCIM or provisioning settings for the CloudThinker application, enter:| Field | Value |
|---|---|
| SCIM connector base URL | The SCIM base URL from Step 1 |
| Authentication mode | HTTP Header / Bearer Token |
| Bearer token | The token from Step 1 |
| Unique identifier field | userName (this maps to the user’s email address) |
What your IdP can sync
| Operation | Supported | What it does |
|---|---|---|
| Create Users | Yes | Adds new user accounts to your CloudThinker organization |
| Update User Attributes | Yes | Keeps name, email, and active status in sync |
| Deactivate Users | Yes | Disables access when a user is deactivated in your IdP |
| Delete Users | Yes | Removes the user from your organization |
| Push Groups | Yes | Syncs your IdP groups to CloudThinker for workspace mapping |
| Group Membership | Yes | Keeps group members in sync between your IdP and CloudThinker |
CloudThinker supports filtering by
userName for user lookups and displayName for group lookups. Bulk operations are not currently supported.Step 3: Map groups to workspaces and roles
Once your IdP starts pushing groups via SCIM, they appear automatically in the Group mappings section on the Identity and access page. Group mappings let you control which workspaces users land in and what role they get, based on their group membership in your IdP. For each synced group, you can configure:| Setting | Description |
|---|---|
| Auto-assigned workspaces | Which workspaces members of this group are automatically added to |
| Auto-assigned organization role | The organization role for members of this group — choose Viewer, Developer, or Admin. Select “Use connection role” to use the default role from your SSO connection settings. |
Wait for groups to appear
After configuring SCIM in your IdP, assign groups to your CloudThinker application. Groups show up in the Group mappings table once your IdP pushes them — this may take a few minutes depending on your IdP’s sync interval.
Choose workspaces
For each group, select which workspaces its members should have access to using the workspace dropdown.
Set roles (optional)
Optionally choose a specific role for each group. If you leave it as “Use connection role,” members get the default role from your SSO connection settings.
If no groups have synced yet, the Group mappings section shows a message: “No groups synced yet. Groups will appear here automatically once your identity provider pushes them via SCIM.”
Managing SCIM tokens
Rotate a token
If your token is compromised or your security policy requires periodic rotation, you can rotate it without downtime:- In the Directory sync (SCIM) section, click Rotate token
- Confirm the rotation — the old token stays valid for 24 more hours, giving you time to update your IdP
- Copy the new token and update it in your IdP’s SCIM configuration
Revoke a token
Switching away from SCIM (to Manual or JIT) automatically revokes the SCIM token and stops all directory sync. Your IdP will no longer be able to create, update, or remove users in CloudThinker.Monitoring sync activity
Click View sync logs in the Directory sync section to see a history of all SCIM operations. This is useful for verifying that your IdP is pushing changes correctly and for troubleshooting provisioning issues. Each log entry shows:| Field | Description |
|---|---|
| Timestamp | When the operation occurred |
| Action | What happened (e.g., CREATE, UPDATE, DELETE) |
| Resource | Which user or group was affected |
| Status | Whether it succeeded (SUCCESS), was skipped (SKIPPED), or failed (FAILED) |
Disabling SCIM
If you no longer need directory sync, you can disable SCIM:- In the Provisioning & directory sync card, select Manual or Just-in-time
- Confirm the action — this immediately revokes your SCIM token and stops all directory sync
- Existing users remain in your organization, but your IdP can no longer add or remove users automatically
Troubleshooting
Groups aren’t appearing in CloudThinker
Make sure groups are assigned to your CloudThinker application in your IdP’s provisioning settings. CloudThinker doesn’t pull groups from your IdP — your IdP needs to push them. Check View sync logs to see if any group sync attempts have been made.Users aren’t being provisioned
- Verify the user is assigned to your CloudThinker application in your IdP
- Check that the SCIM token hasn’t been rotated or revoked — if in doubt, rotate the token and update your IdP
- Open View sync logs and look for FAILED entries — these often include details about what went wrong
- Make sure the user’s email address is valid and not already associated with a different CloudThinker organization
Users aren’t being deprovisioned
- Make sure the user was removed from the CloudThinker application in your IdP (removing them from a group alone isn’t enough — they need to be unassigned from the application)
- Check sync logs for a DELETE or DEACTIVATE action for that user
- Some IdPs don’t sync changes instantly — for example, Microsoft Entra syncs approximately every 40 minutes. Wait for the next cycle and check again.