What Is SCIM? The Account Provisioning Standard
The definition and workings of SCIM, the standard for automatically creating, updating, and deactivating accounts across systems.
SCIM (System for Cross-domain Identity Management) is a protocol for exchanging user account information between systems in a standard way. It is a convention that automatically reflects the creation, modification, and deactivation of accounts from a single source to multiple systems, defined by a schema (RFC 7643) and a protocol (RFC 7644).
The problem SCIM solves
When account management is manual, omissions grow as apps increase. Creating an account by hand in each app for a new hire, and finding and disabling a leaver's account in each app, takes a long time and is error-prone. In particular, when a leaver's account removal lags, it becomes a security and compliance risk.
SCIM automates this process. Because account information travels in a standard format, creating or deactivating an account in one place reflects that change in the connected systems.
How SCIM works
SCIM uses REST and JSON, and handles users and groups through /Users and /Groups endpoints respectively. The side that creates accounts (usually the HR system or an upstream directory) sends requests, and the side that receives accounts processes those requests through the SCIM API. In other words, SCIM has a sending side and a receiving side. Making clear which system takes which role before adoption helps you avoid the confusion of accounts being created separately on both sides.
What to check before adopting SCIM
You need to decide first which of the apps your company uses support SCIM, where to place the account source, and how to design groups and roles. This design becomes your access policy.
AxiPass provides a SCIM 2.0 API as a receiving server. From the HR system or upstream directory, you can automatically reflect account creation, modification, and deactivation into AxiPass. The practice of automating on- and offboarding with SCIM continues in Offboarding Delays and How SCIM Automates Account Removal, and you can start for free to see it for yourself.