> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Groups

> Use SCIM to standardize the process of provisioning groups of users to Connect AI, assigning roles, and removing groups from Connect AI.

SCIM group provisioning lets you manage Connect AI access by syncing groups from your identity provider (IdP). Groups synced from your IdP are read-only in Connect AI. Create, update, and delete groups in your IdP, and SCIM keeps Connect AI in sync.

<Note>SSO must be configured on your account before you can enable SCIM Groups. To enable SCIM, contact [CData Support](https://www.cdata.com/support/submit.aspx).</Note>

Connect AI supports SCIM group provisioning with the following identity providers:

* Microsoft Entra ID
* Okta Workforce Identity Cloud
* Custom IdP (configured via SAML or OpenID Connect)

The following SCIM providers are NOT supported:

* PingFederate
* Google Workspace
* Active Directory Federation Services (ADFS)
* Active Directory/LDAP

## SCIM Groups User Provisioning and Deprovisioning

When a user is added to a synced group in your IdP, Connect AI automatically provisions them. There is no need for the user to verify via email. The new user inherits the roles assigned to that group. See [Role Assignments](#role-assignments) for details on assigning roles to groups.

When a user is removed from a synced group, they lose the roles assigned to that group. If the user is a member of multiple synced groups, they retain access through their remaining group memberships. To fully deprovision a user, remove them from all synced groups in your IdP and then call `DELETE /users/{id}` from the Management API to revoke PATs and any direct role and permission grants. The user record is retained but the user can no longer sign in.

## Role Assignments

After groups are synced, you assign Connect AI roles to groups using the Management API. All current and future members of the group automatically receive the assigned roles. A group can hold multiple roles, and the same role can be assigned to multiple groups.

Use the following endpoints (base path `/api/v1/`) to manage group role assignments:

| Method   | Path                           | Description                                        |
| -------- | ------------------------------ | -------------------------------------------------- |
| `GET`    | `/groups`                      | List all SCIM-synced groups                        |
| `GET`    | `/groups/{id}`                 | Get a group and its current role assignments       |
| `POST`   | `/groups/{id}/roles`           | Assign a role to a group                           |
| `GET`    | `/groups/{id}/roles`           | List all roles assigned to a group                 |
| `DELETE` | `/groups/{id}/roles/{role_id}` | Remove a role assignment from a group              |
| `GET`    | `/roles/{id}/groups`           | List all groups that have a specific role assigned |

When you remove a role assignment from a group, members who held that role solely through this group assignment immediately lose it. See [Roles](/en/Roles) for details on system and access roles.

The Connect AI [Audit Log](/en/Logs#audit-log) displays SCIM group provisioning, membership changes, and role assignment changes.