Skip to main content
Available on the Enterprise plan. Currently in beta. Contact sales to learn more.
SCIM (System for Cross-domain Identity Management) lets your identity provider automatically create, update, and deactivate user accounts in Ona. Instead of manually inviting users or removing access, your IdP pushes changes to Ona as they happen in your directory.

​
How it works

When SCIM is configured, your identity provider communicates with Ona through a SCIM endpoint using a bearer token for authentication. Changes in your IdP directory, such as adding a new employee or disabling an account, are automatically reflected in your Ona organization. SCIM provisioning is linked to an existing SSO login provider. The linked SSO configuration determines how provisioned users authenticate when signing in to Ona. Each SCIM bearer token is scoped to one SCIM configuration. The token can list and manage only groups created by that configuration. Groups created by another SCIM configuration, system-managed groups, and direct-share groups are excluded from list results. Requests to retrieve or modify those groups return 404 Not Found. A SCIM bearer token can list or modify only users owned by its linked SSO configuration. If multiple SCIM configurations link to the same SSO configuration, their tokens share access to those users. Requests for a user owned by a different SSO configuration return 404 Not Found.

​
Prerequisites

  • An active SSO login provider configured in your organization
  • Admin-level access to your organization settings in Ona
  • Admin access to your identity provider (e.g., Microsoft Entra ID)

​
Setting up SCIM in Ona

​
Step 1. Open SCIM configuration

Navigate to Organization Settings > Login and Security. Scroll to the SCIM Provisioning section. SCIM not configured SCIM Provisioning: initial state Click Setup now to begin.

​
Step 2. Create a SCIM configuration

In the configuration dialog:
  1. Select the Linked SSO configuration. This is the SSO provider that provisioned users will use to sign in
  2. Enter a Name for this SCIM configuration
  3. Click Create
New SCIM configuration New SCIM configuration: select SSO provider and name After creation, Ona displays the SCIM endpoint URL and a bearer token.
Copy the bearer token immediately. It is shown only once and cannot be retrieved later.
You will need both the endpoint URL and the token to configure your identity provider in the next step.

​
Configuring your identity provider

​
Microsoft Entra ID

​
Creating an Enterprise Application

If you don’t already have an Enterprise Application for Ona, create one:
  1. Open the Microsoft Entra admin center
  2. Navigate to Enterprise Applications
  3. Click New application, then select Create your own application
  4. Enter a name for the application (e.g., Ona)
  5. Select Integrate any other application you don’t find in the gallery (Non-gallery)
  6. Click Create
Create your own application in Entra Microsoft Entra: create a non-gallery enterprise application

​
Configuring provisioning

  1. In the Microsoft Entra admin center, navigate to Enterprise Applications and select the application you created for Ona
  2. Go to Provisioning and select Provisioning again
  3. Set Provisioning Mode to Automatic
  4. Under Admin Credentials, configure the following:
    • Authentication Method: Bearer Authentication
    • Tenant URL: Paste the SCIM endpoint URL from Ona
    • Secret Token: Paste the bearer token from Ona
  5. Click Test Connection to verify the configuration
Once the test succeeds, save the configuration and enable provisioning.

​
Scoping users

We recommend provisioning only the users who will use Ona, rather than your entire directory. You can control this with scoping filters in your identity provider. In Microsoft Entra:
  1. In the Provisioning tab, select Mappings
  2. Open the mapping for Users or Groups
  3. Under Source Object Scope, add a Scoping Filter Group to limit which users are provisioned
For details on building scoping filters, see Microsoft’s scoping filter documentation.

​
Restricting account creation to SCIM

Once SCIM is configured and enabled, you can require that all organization access goes through SCIM by enabling the Restrict account creation to SCIM policy. When enabled, users who can authenticate via SSO but are not provisioned through SCIM are blocked from joining the organization. This is useful when you want your identity provider to be the single source of truth for who has access to Ona.