# SCIM provisioning (/security/scim-provisioning) SCIM lets your identity provider — Okta, Azure AD, Google Workspace — push user lifecycle into a project instead of relying on people logging in through SSO. The headline benefit is **automatic deprovisioning**: deactivate someone in your IdP and their access is suspended immediately, even if they never sign in again. Scope covers both **Users and Groups**. ## Setup In **Settings → SSO**, turn on the SCIM connector. Bitelio gives you two things to put in your IdP's SCIM app configuration: * **Base URL** — the endpoint your IdP sends SCIM requests to. * **Bearer token** — generated on demand, shown once. Copy it into your IdP immediately; if you lose it, rotate to get a new one rather than trying to recover the old value. ## Groups back roles A SCIM group maps to a project role by matching the group's **display name** to a role name. Adding a user to that group in your IdP sets their role on the project; removing them reverts to the connector's default role. Membership in Bitelio is single-role, so if a user ends up in more than one mapped group, whichever SCIM operation was applied last decides the role — there's no combining of permissions across groups. The **Owner** role can never be assigned through SCIM, in either direction: no SCIM group can back it, and no SCIM operation can promote a member into it. Ownership changes stay a manual, in-app action. ## Deprovisioning Deactivating a user in your IdP (or sending a SCIM delete) suspends their membership rather than deleting anything — a suspended member is blocked from that project immediately, but the underlying account and their history are untouched. Reactivating the same user in your IdP restores access; nothing on the Bitelio side needs to be redone. SCIM provisioning follows the same domain-verification and anti-hijack rules as SSO: a new user can only be created on a verified domain (or an unverified one if the connector allows it), and an existing account on another domain can never be attached this way. ## What's next Pair SCIM with SAML or OIDC so members sign in and their lifecycle is managed together. Back to the overview of the access-control surface.