Skip to main content

SCIM provisioning

Connect docs via MCP

SCIM (System for Cross-domain Identity Management) is an optional layer that sits on top of your existing SSO setup. Instead of users being created in Atlan only when they first sign in, SCIM lets your identity provider drive the full lifecycle: provisioning new accounts ahead of first login, keeping names, emails, and group memberships in sync as they change, and automatically deactivating accounts when someone leaves.

SSO-only (JIT) works fine for smaller or early-stage workspaces. Consider adding SCIM when:

  • Your team regularly onboards and offboards people and you need accounts deactivated automatically when someone leaves.
  • You need users to exist in Atlan before they sign in, for governance workflows, asset ownership assignments, or pre-migration setups.
  • Group membership changes frequently and you don't want updates to wait until each user's next login.
  • You want the IdP to be the single source of truth for user state with no manual cleanup in Atlan.

Atlan supports SCIM 2.0 with Azure AD / Entra and Okta. SSO must be configured first. SCIM adds to it, not replaces it. If users were already created via JIT before enabling SCIM, verify their username format matches what your IdP sends. Mismatches can cause provisioning conflicts.

SSO-only vs SCIM​

Without SCIM

SSO with Just-in-Time (JIT) provisioning

Onboarding

User is created only on their first SSO login. No pre-creation.

Profile attributes

Synced once at first login. Later IdP changes don't reflect.

Group assignment

Mapped at login. Changes only apply at the user's next login.

Offboarding

Account stays active when removed from the IdP. An admin must disable it manually.

Ownership pre-login

Can't assign users as asset owners until they've logged in once.

With SCIM

Automated provisioning, IdP-driven

Onboarding

Users are auto-created via the IdP cycle, before they ever log in.

Profile attributes

Name, email, username and groups stay in sync through ongoing cycles.

Group assignment

Mapped IdP groups are SCIM-managed, with no manual additions needed.

Offboarding

Removed or disabled in the IdP → auto-deactivated on next sync.

Ownership pre-login

Provisioned users can be set as asset owners before first login.

Things to know before you start​

  • Username is permanent. Once a user is provisioned via SCIM, their Atlan username cannot be changed. Confirm your IdP username format before enabling.
  • Sync isn't always instant. Azure AD's default provisioning cycle runs approximately every 40 minutes. Okta can be triggered on demand. Plan for this delay when onboarding users.
  • Azure licensing. SCIM through Entra ID may require a Microsoft Entra ID P1 or P2 license.
  • Admin controls shift. Once SCIM is on, user profile edits, enables, and disables for SCIM-managed users flow through the IdP, not from within Atlan.

Set up SCIM for your identity provider​

Az

Azure AD / Entra

Generate a SCIM token in Atlan, configure the provisioning connector in Entra, map user and group attributes, and start syncing.

Ok

Okta

Enable SCIM on the Okta app, configure the connection, map user attributes, and optionally push groups to Atlan.

See also​