Skip to main content
SCIM (System for Cross-domain Identity Management) lets your identity provider deprovision people who already have a Sprig account.
SCIM is only available for customers on the Enterprise plan.

​
SCIM

Sprig supports SCIM 2.0 for deprovisioning users who are already on your team. The SCIM 2.0 base URL is /scim/v2/<locator>/Users:
The locator and the token come from Sprig’s SCIM settings. Open Settings > Single Sign-On and use the User deprovisioning (SCIM) section. Copy the SCIM endpoint URL from that section when an identity provider asks for a SCIM base URL. It includes the locator and has no /Users suffix. On production it looks like https://api.sprig.com/scim/v2/<locator>. The provider adds /Users to reach the users resource above. Authentication is the header:
userName must be the person’s existing Sprig email, the same address they use to sign in to the Sprig dashboard. Sprig does not create users through SCIM. The person must already be on the team. Sprig does not sync passwords. Deprovisioning sets the user inactive. Sprig soft-deletes the dashboard user when the identity provider sends active: false. SCIM updates do not change the login email. When Sprig soft-deletes a user, the login email becomes <uuid>@deleted.com and the previous email is kept as scimUserName. Import and groups are not supported. Name updates are not available yet.

​
Generate the token

  1. Open Settings > Single Sign-On.
  2. In User deprovisioning (SCIM), turn on Enable SCIM. This creates the locator and the SCIM endpoint URL. It does not create a token.
  3. Create the API key. Sprig opens Save your API Key and shows the full key once. Copy it with Copy Key, then click Done. You won’t be able to view the full key again.
Save your API Key modal. The full key is shown once.
  1. After Done, the API Key field shows a six-character preview, who created the key, and Regenerate Token. That preview will not authenticate.
Single Sign-On settings with Enable SCIM on, the SCIM endpoint URL, and the API key preview. Copy the SCIM endpoint URL from this page. The host matches the Sprig environment you are signed into. Regenerate Token shows a new full key once in the same modal. The previous key stops working immediately.

​
Okta

Use a private Okta SCIM 2.0 Test App (Header Auth). This is the setup that was tested. Add the app for your own organization. Do not submit the app to the Okta Integration Network.
  1. In the Okta Admin Console, add a private SCIM 2.0 Test App (Header Auth).
  2. Set the username format to Email, so Okta sends the person’s existing Sprig dashboard email as SCIM userName.
  3. Set the SCIM connector base URL to the endpoint from Sprig’s SCIM settings. Include the locator. Leave off the /Users suffix. The value looks like https://api.sprig.com/scim/v2/<locator>.
  4. In Okta’s API Token field, enter Bearer <full token>. That is the whole Authorization header value: the word Bearer, a space, and the full one-time token.
Okta’s SCIM 2.0 Test App (Header Auth) sends the API Token field as the raw Authorization header. Sprig only accepts Authorization: Bearer <token>.
Enter the word Bearer, a space, and the full one-time token. The raw token will not authenticate, and the six-character preview Sprig shows will not authenticate. A raw token with no Bearer prefix returns 401 Missing bearer token.
  1. Open Provisioning > To App and set:
  • Create Users: On. This only lets Okta link an existing Sprig user by email. Sprig still does not create the user. The person must already exist on the team.
  • Deactivate Users: On. Unassigning a user, or deactivating them in Okta, sends active: false. Sprig soft-deletes the dashboard user.
  • Update User Attributes: Off. Leave this off. Name updates are not available yet. If it is on, Okta sends a full-profile PUT /Users/:id when you assign the user. Sprig responds 501 Not Implemented, Okta marks the assignment as failed, and unassigning the user later sends no deactivation request.
  • Sync Password: Off. Sprig does not sync passwords.
Import and groups are not supported.

​
Verify the Okta setup

  1. Assign a test user who already has a Sprig account. Use that person’s Sprig email.
  2. Confirm Okta shows no provisioning error.
  3. Unassign that user and confirm they lose access to Sprig.

​
Microsoft Entra ID

Use a non-gallery enterprise application in Microsoft Entra ID with automatic provisioning.
  1. In the Microsoft Entra admin center, open Enterprise apps, click New application, then Create your own application. Name it (for example, Sprig) and choose the option to integrate an application that is not in the gallery.
  2. Open Provisioning and start a new provisioning configuration.
  3. Set Select authentication method to Bearer authentication.
  4. Set Tenant URL to the endpoint from Sprig’s SCIM settings. The path stops at the locator. Leave off the /Users suffix. The value looks like https://api.sprig.com/scim/v2/<locator>.
  5. Set Secret token to the full one-time Sprig token, with no prefix. Entra adds Bearer itself.
  6. Click Test connection.
Entra New provisioning configuration with Bearer authentication, Tenant URL, Secret token, and Test connection.
Do not type Bearer in the Secret token field. Unlike Okta, Entra adds it. The six-character preview Sprig shows will not authenticate.

​
Configure attribute mapping

Open Attribute mapping for users.
  1. Edit the userName row. Set the source attribute to mail, check Match objects using this attribute, and set Matching precedence to 1.
Entra Edit Attribute Mapping with mail mapped to userName, Match objects using this attribute checked, and matching precedence 1. The person’s Entra Email must equal the email they use to sign in to Sprig. The onmicrosoft.com sign-in name is not enough. Set the Email property on the Entra user.
  1. Keep only these five mappings:
  1. Delete Entra’s other default rows.
Remove emails[type eq "work"].value and name.formatted. Sprig returns 501 Not Implemented for that emails path, and provisioning fails while those rows remain.
Entra Attribute mapping with the five mappings to keep: mail, displayName, givenName, surname, and the IsSoftDeleted expression mapped to active.
  1. Under Target object actions, leave Create unchecked. Sprig does not create users through SCIM. POST /Users returns 501 Not Implemented. The person must already exist in Sprig.

​
Configure scope

  1. In Provisioning, keep Provisioning Mode on Automatic.
  2. Under Settings, set Scope to Sync only assigned users and groups.
  3. Leave Provisioning Status Off until Provision on demand succeeds.
  4. Open Users and groups and assign a test user who already has a Sprig account.
Entra Provisioning with Automatic mode and provisioning status On.

​
Verify the Entra setup

  1. Open Provision on demand and run it for the test user. Entra matches the user by email. A match shows as an update, not a create.
  2. If the user’s Email is empty, Entra skips them with UnprocessableEntry. Set the Email property and run it again.
  3. When Provision on demand succeeds, set Provisioning Status to On and save.

​
Deprovision with Entra

With the IsSoftDeleted mapping above, deleting the user in Entra sends active: false. Blocking sign-in for the user does not. Sprig soft-deletes the dashboard user. The login email becomes <uuid>@deleted.com, and the previous email is kept as scimUserName.
Deactivating the only organization admin returns 409 Conflict. Make another person an admin first.

​
Google

Google does not currently support SCIM.

​
Other providers

Only Okta and Microsoft Entra ID have been verified. A SCIM 2.0 provider can deprovision an existing Sprig user when it sends:
  • Base URL: the Sprig endpoint including the locator, with no /Users suffix (https://api.sprig.com/scim/v2/<locator>). The users resource is /scim/v2/<locator>/Users.
  • Authorization: Authorization: Bearer <full one-time token>. The six-character preview will not authenticate.
  • userName: the person’s existing Sprig email.
  • Deprovision: active: false. Sprig soft-deletes the user.
Sprig does not create users, sync passwords, or update names through SCIM. SCIM updates do not change the login email. Import and groups are not supported.