SCIM provisioning
Your identity provider pushes people, titles, departments, and managers to Sprooster the moment they change.
With SCIM, your identity provider pushes changes to Sprooster as they happen: new hires appear, title changes land, manager moves update the chart, and leavers are deactivated, all without Sprooster holding any credentials to your directory. It works with any SCIM 2.0 provisioning engine: Microsoft Entra ID, Okta, JumpCloud, OneLogin, and others.
SCIM and SAML single sign-on are independent halves: SCIM fills the chart, SAML signs people in. Run either or both. If you already use the Microsoft 365 or Google Workspace pull connection, pick one source per workspace. Don't run pull and SCIM side by side.
1. Mint your SCIM token
A workspace admin mints the token (it authenticates your IdP to Sprooster):
curl -X POST https://<app>/api/tenant/scim-token(A Settings card for this is coming; until then we're happy to mint it with you: help@sprooster.com.)
The response contains the token once: Sprooster stores only a hash and can never show it again. Minting a new token invalidates the old one, which is also how you rotate or revoke.
2. Point your IdP at Sprooster
| Setting | Value |
|---|---|
| SCIM endpoint / Tenant URL | https://<app>/api/scim/v2 |
| Authentication | Bearer token (from step 1) |
- Entra ID: your app's Provisioning tab → mode Automatic → paste Tenant URL + Secret Token → Test Connection → save → Start provisioning.
- Okta: app's Provisioning tab → Integration → SCIM 2.0, Bearer auth → enable Create/Update/Deactivate Users on the To App tab.
Scope provisioning to the users/groups you want on the chart. Sprooster stores whatever your IdP assigns.
What Sprooster reads
userName (the work email, which is how people match up across sources), name, display
name, title, active, work email and phone, and from the enterprise user extension:
department and manager. Groups aren't used. Manager and department come from the
user record, which is what draws the chart.
Notes for IT admins
- Deactivation, not deletion: when someone leaves, your IdP sets
active: falseand they drop off the chart but keep their history. A hard SCIMDELETEremoves the record. - Email changes are safe: the SCIM record keeps its id; reports pointing at a renamed manager follow automatically.
- CSV bootstrap hand-off: if the workspace started from a CSV upload, provisioned people take over their CSV rows by work-email match. History carries over.
- Every push is logged — each create/update/deactivate leaves an auditable run record, the same trail our scheduled directory syncs write.