SCIM provisioning

SCIM lets your identity provider — Okta, Azure AD, Google Workspace — push user lifecycle into a project instead of relying on people logging in through SSO. The headline benefit is automatic deprovisioning: deactivate someone in your IdP and their access is suspended immediately, even if they never sign in again. Scope covers both Users and Groups.

Setup

In Settings → SSO, turn on the SCIM connector. Bitelio gives you two things to put in your IdP's SCIM app configuration:

• Base URL — the endpoint your IdP sends SCIM requests to.
• Bearer token — generated on demand, shown once. Copy it into your IdP immediately; if you lose it, rotate to get a new one rather than trying to recover the old value.

Groups back roles

A SCIM group maps to a project role by matching the group's display name to a role name. Adding a user to that group in your IdP sets their role on the project; removing them reverts to the connector's default role.

Membership in Bitelio is single-role, so if a user ends up in more than one mapped group, whichever SCIM operation was applied last decides the role — there's no combining of permissions across groups.

The Owner role can never be assigned through SCIM, in either direction: no SCIM group can back it, and no SCIM operation can promote a member into it. Ownership changes stay a manual, in-app action.

Deprovisioning

Deactivating a user in your IdP (or sending a SCIM delete) suspends their membership rather than deleting anything — a suspended member is blocked from that project immediately, but the underlying account and their history are untouched. Reactivating the same user in your IdP restores access; nothing on the Bitelio side needs to be redone.

SCIM provisioning follows the same domain-verification and anti-hijack rules as SSO: a new user can only be created on a verified domain (or an unverified one if the connector allows it), and an existing account on another domain can never be attached this way.

What's next