> ## Documentation Index > Fetch the complete documentation index at: https://docs.sprig.com/llms.txt > Use this file to discover all available pages before exploring further. # SCIM > Deprovision existing Sprig users from your identity provider SCIM (System for Cross-domain Identity Management) lets your identity provider deprovision people who already have a Sprig account. > [!NOTE] > > SCIM is only available for customers on the Enterprise plan. ## SCIM Sprig supports SCIM 2.0 for deprovisioning users who are already on your team. The SCIM 2.0 base URL is `/scim/v2//Users`: ```text theme={null} https://api.sprig.com/scim/v2//Users ``` The locator and the token come from Sprig's SCIM settings. Open **Settings >** [**Single Sign-On**](https://app.sprig.com/settings/sso) and use the **User deprovisioning (SCIM)** section. Copy the **SCIM endpoint URL** from that section when an identity provider asks for a SCIM base URL. It includes the locator and has no `/Users` suffix. On production it looks like `https://api.sprig.com/scim/v2/`. The provider adds `/Users` to reach the users resource above. Authentication is the header: ```text theme={null} Authorization: Bearer ``` `userName` must be the person's existing Sprig email, the same address they use to sign in to the Sprig dashboard. Sprig does not create users through SCIM. The person must already be on the team. Sprig does not sync passwords. Deprovisioning sets the user inactive. Sprig soft-deletes the dashboard user when the identity provider sends `active: false`. SCIM updates do not change the login email. When Sprig soft-deletes a user, the login email becomes `@deleted.com` and the previous email is kept as `scimUserName`. Import and groups are not supported. Name updates are not available yet. ### Generate the token 1. Open **Settings >** [**Single Sign-On**](https://app.sprig.com/settings/sso). 2. In **User deprovisioning (SCIM)**, turn on **Enable SCIM**. This creates the locator and the **SCIM endpoint URL**. It does not create a token. 3. Create the API key. Sprig opens **Save your API Key** and shows the full key once. Copy it with **Copy Key**, then click **Done**. You won't be able to view the full key again. ![Save your API Key modal. The full key is shown once.](https://mintcdn.com/sprig/Kq0TmQejyBi0KRjY/images/scim-save-api-key.png?fit=max\&auto=format\&n=Kq0TmQejyBi0KRjY\&q=85\&s=86d0f097aaf2a9d7a274ae4487ab1c92) 4. After **Done**, the **API Key** field shows a six-character preview, who created the key, and **Regenerate Token**. That preview will not authenticate. ![Single Sign-On settings with Enable SCIM on, the SCIM endpoint URL, and the API key preview.](https://mintcdn.com/sprig/Kq0TmQejyBi0KRjY/images/scim-user-deprovisioning.png?fit=max\&auto=format\&n=Kq0TmQejyBi0KRjY\&q=85\&s=9122d5bcc6cff7de78aae00f9a922418) Copy the **SCIM endpoint URL** from this page. The host matches the Sprig environment you are signed into. **Regenerate Token** shows a new full key once in the same modal. The previous key stops working immediately. ## Okta Use a private Okta **SCIM 2.0 Test App (Header Auth)**. This is the setup that was tested. Add the app for your own organization. Do not submit the app to the Okta Integration Network. 1. In the Okta Admin Console, add a private **SCIM 2.0 Test App (Header Auth)**. 2. Set the username format to **Email**, so Okta sends the person's existing Sprig dashboard email as SCIM `userName`. 3. Set the SCIM connector base URL to the endpoint from Sprig's SCIM settings. Include the locator. Leave off the `/Users` suffix. The value looks like `https://api.sprig.com/scim/v2/`. 4. In Okta's **API Token** field, enter `Bearer `. That is the whole Authorization header value: the word `Bearer`, a space, and the full one-time token. Okta's SCIM 2.0 Test App (Header Auth) sends the API Token field as the raw Authorization header. Sprig only accepts `Authorization: Bearer `. > [!WARNING] > > Enter the word `Bearer`, a space, and the full one-time token. The raw token will not authenticate, and the six-character preview Sprig shows will not authenticate. A raw token with no `Bearer` prefix returns `401 Missing bearer token`. 5. Open **Provisioning > To App** and set: * **Create Users:** On. This only lets Okta link an existing Sprig user by email. Sprig still does not create the user. The person must already exist on the team. * **Deactivate Users:** On. Unassigning a user, or deactivating them in Okta, sends `active: false`. Sprig soft-deletes the dashboard user. * **Update User Attributes:** Off. Leave this off. Name updates are not available yet. If it is on, Okta sends a full-profile `PUT /Users/:id` when you assign the user. Sprig responds `501 Not Implemented`, Okta marks the assignment as failed, and unassigning the user later sends no deactivation request. * **Sync Password:** Off. Sprig does not sync passwords. Import and groups are not supported. ### Verify the Okta setup 1. Assign a test user who already has a Sprig account. Use that person's Sprig email. 2. Confirm Okta shows no provisioning error. 3. Unassign that user and confirm they lose access to Sprig. ## Microsoft Entra ID Use a non-gallery enterprise application in Microsoft Entra ID with automatic provisioning. 1. In the Microsoft Entra admin center, open **Enterprise apps**, click **New application**, then **Create your own application**. Name it (for example, `Sprig`) and choose the option to integrate an application that is not in the gallery. 2. Open **Provisioning** and start a new provisioning configuration. 3. Set **Select authentication method** to **Bearer authentication**. 4. Set **Tenant URL** to the endpoint from Sprig's SCIM settings. The path stops at the locator. Leave off the `/Users` suffix. The value looks like `https://api.sprig.com/scim/v2/`. 5. Set **Secret token** to the full one-time Sprig token, with no prefix. Entra adds `Bearer` itself. 6. Click **Test connection**. ![Entra New provisioning configuration with Bearer authentication, Tenant URL, Secret token, and Test connection.](https://mintcdn.com/sprig/Kq0TmQejyBi0KRjY/images/scim-entra-provisioning-credentials.png?fit=max\&auto=format\&n=Kq0TmQejyBi0KRjY\&q=85\&s=e5350dbdb977abfa4aa832804cc1eedd) > [!WARNING] > > Do not type `Bearer` in the **Secret token** field. Unlike Okta, Entra adds it. The six-character preview Sprig shows will not authenticate. ### Configure attribute mapping Open **Attribute mapping** for users. 1. Edit the `userName` row. Set the source attribute to `mail`, check **Match objects using this attribute**, and set **Matching precedence** to `1`. ![Entra Edit Attribute Mapping with mail mapped to userName, Match objects using this attribute checked, and matching precedence 1.](https://mintcdn.com/sprig/Kq0TmQejyBi0KRjY/images/scim-entra-username-mapping.png?fit=max\&auto=format\&n=Kq0TmQejyBi0KRjY\&q=85\&s=629bc68ab94bf0d88ca85f325b703e66) The person's Entra **Email** must equal the email they use to sign in to Sprig. The `onmicrosoft.com` sign-in name is not enough. Set the **Email** property on the Entra user. 2. Keep only these five mappings: | Source attribute (Microsoft Entra ID) | Target attribute | | - | - | | `mail` | `userName` | | `givenName` | `name.givenName` | | `surname` | `name.familyName` | | `displayName` | `displayName` | | `Switch([IsSoftDeleted], , "False", "True", "True", "False")` | `active` | 3. Delete Entra's other default rows. > [!WARNING] > > Remove `emails[type eq "work"].value` and `name.formatted`. Sprig returns `501 Not Implemented` for that emails path, and provisioning fails while those rows remain. ![Entra Attribute mapping with the five mappings to keep: mail, displayName, givenName, surname, and the IsSoftDeleted expression mapped to active.](https://mintcdn.com/sprig/Kq0TmQejyBi0KRjY/images/scim-entra-attribute-mapping.png?fit=max\&auto=format\&n=Kq0TmQejyBi0KRjY\&q=85\&s=a9fdc28c384fb314f2a7599971023aa6) 4. Under **Target object actions**, leave **Create** unchecked. Sprig does not create users through SCIM. `POST /Users` returns `501 Not Implemented`. The person must already exist in Sprig. ### Configure scope 1. In **Provisioning**, keep **Provisioning Mode** on **Automatic**. 2. Under **Settings**, set **Scope** to **Sync only assigned users and groups**. 3. Leave **Provisioning Status** **Off** until **Provision on demand** succeeds. 4. Open **Users and groups** and assign a test user who already has a Sprig account. ![Entra Provisioning with Automatic mode and provisioning status On.](https://mintcdn.com/sprig/Kq0TmQejyBi0KRjY/images/scim-entra-provisioning-settings.png?fit=max\&auto=format\&n=Kq0TmQejyBi0KRjY\&q=85\&s=5f397987591668a96d2c5c78cd6985e1) ### Verify the Entra setup 1. Open **Provision on demand** and run it for the test user. Entra matches the user by email. A match shows as an update, not a create. 2. If the user's **Email** is empty, Entra skips them with `UnprocessableEntry`. Set the **Email** property and run it again. 3. When **Provision on demand** succeeds, set **Provisioning Status** to **On** and save. ### Deprovision with Entra With the `IsSoftDeleted` mapping above, deleting the user in Entra sends `active: false`. Blocking sign-in for the user does not. Sprig soft-deletes the dashboard user. The login email becomes `@deleted.com`, and the previous email is kept as `scimUserName`. > [!NOTE] > > Deactivating the only organization admin returns `409 Conflict`. Make another person an admin first. ## Google Google does not currently support SCIM. ## Other providers Only Okta and Microsoft Entra ID have been verified. A SCIM 2.0 provider can deprovision an existing Sprig user when it sends: * **Base URL:** the Sprig endpoint including the locator, with no `/Users` suffix (`https://api.sprig.com/scim/v2/`). The users resource is `/scim/v2//Users`. * **Authorization:** `Authorization: Bearer `. The six-character preview will not authenticate. * **userName:** the person's existing Sprig email. * **Deprovision:** `active: false`. Sprig soft-deletes the user. Sprig does not create users, sync passwords, or update names through SCIM. SCIM updates do not change the login email. Import and groups are not supported.