SCIM provisioning (Okta, Entra, OneLogin, JumpCloud)

#Set up

1. In WorkplaceSignatures open Directory → SCIM and Generate token. Copy it: it's shown once.
2. In your IdP, add a SCIM 2.0 app (often "SCIM provisioning" or a custom app) with:
   • Base URL: https://<your app address>/api/scim/v2
   • Authentication: HTTP header / Bearer token, using the token from step 1
   • Unique identifier: userName (the email address)
3. Enable Create users, Update user attributes and Deactivate users.
4. Disable group push: it isn't supported (group requests return 501).
5. Assign the users or groups who should have signatures.

#What happens

• Created / activated → employee created, seat opened, signature deployed.
• Attributes updated → signature re-rendered; redeployed only if it changed.
• Deactivated (active: false) → seat closed that day, signature removed.
• Deleted → archived: seat closed, history kept.

#Supported

Users GET / POST / PUT / PATCH / DELETE, eq filters on userName, externalId, emails.value and id, pagination, and the enterprise extension (department, employeeNumber, manager, …). PATCH accepts Entra's capitalized operations and string booleans.

#Rotating tokens

Generate a new token, update your IdP, then revoke the old one in Directory → SCIM. If you cancel your subscription, all SCIM tokens are revoked; after reactivating, generate a new one.