Skip to main content
SCIM group provisioning lets you manage Connect AI access by syncing groups from your identity provider (IdP). Groups synced from your IdP are read-only in Connect AI. Create, update, and delete groups in your IdP, and SCIM keeps Connect AI in sync.
SSO must be configured on your account before you can enable SCIM Groups. To enable SCIM, contact CData Support.
Connect AI supports SCIM group provisioning with the following identity providers:
  • Microsoft Entra ID
  • Okta Workforce Identity Cloud
  • Custom IdP (configured via SAML or OpenID Connect)
The following SCIM providers are NOT supported:
  • PingFederate
  • Google Workspace
  • Active Directory Federation Services (ADFS)
  • Active Directory/LDAP

​
SCIM Groups User Provisioning and Deprovisioning

When a user is added to a synced group in your IdP, Connect AI automatically provisions them. There is no need for the user to verify via email. The new user inherits the roles assigned to that group. See Role Assignments for details on assigning roles to groups. When a user is removed from a synced group, they lose the roles assigned to that group. If the user is a member of multiple synced groups, they retain access through their remaining group memberships. To fully deprovision a user, remove them from all synced groups in your IdP and then call DELETE /users/{id} from the Management API to revoke PATs and any direct role and permission grants. The user record is retained but the user can no longer sign in.

​
Role Assignments

After groups are synced, you assign Connect AI roles to groups using the Management API. All current and future members of the group automatically receive the assigned roles. A group can hold multiple roles, and the same role can be assigned to multiple groups. Use the following endpoints (base path /api/v1/) to manage group role assignments: When you remove a role assignment from a group, members who held that role solely through this group assignment immediately lose it. See Roles for details on system and access roles. The Connect AI Audit Log displays SCIM group provisioning, membership changes, and role assignment changes.