SCIM
System for Cross-domain Identity Management — a standard for automatically syncing users, groups, and access from your identity provider to a SaaS app.
SCIM lets your identity provider (like Okta) automatically create, update, and disable user accounts in a SaaS app as employees join, change roles, or leave. Without SCIM, an admin manually invites new hires to each SaaS tool and manually removes them at offboarding.
SCIM is a REST API standard (v2.0 current). When admins add someone to a "Marketing" group in Okta, the SaaS app receives a SCIM message: "create user X with role Y, assign to Marketing". When you disable that user in Okta, the app receives "deactivate user X" and releases the seat automatically.
Why SCIM matters at scale: - **Onboarding**: a 500-person company hiring 20 people a month can't have an admin manually inviting each new hire to every tool. - **Offboarding security**: when someone leaves, access should be gone in minutes, not by-hand by end of week. - **Access reviews**: quarterly "who has access to what" audits become tractable when access is centrally managed via the IdP.
SCIM is not the same as SSO. SSO handles login (proving who you are); SCIM handles account lifecycle. Companies usually implement both; enterprise procurement often requires both.
SCIM is more expensive to implement than SSO — it requires real bidirectional API work per identity provider. Many products ship SSO first and add SCIM later.