Skip to main content
The System for Cross-domain Identity Management (SCIM) is a standard for managing user provisioning, updates, and deletions in cloud-based applications. It allows you to use your company’s identity provider, such as Okta or Entra ID, to provision, update, and delete users securely in Connect AI.

​
Prerequisites

  • SSO must be configured on your Connect AI account before you can enable SCIM Users.
  • SCIM Users must be enabled on your account. Contact CData Support to enable SCIM Users.
  • Microsoft Entra ID license requirement (Entra ID only): Automated SCIM provisioning requires Microsoft Entra ID Premium P1 or P2 (included with Microsoft 365 E3/E5). Organizations on the Entra ID free tier cannot configure automated provisioning.
Connect AI supports SCIM provisioning with the following identity providers:
  • Microsoft Entra ID
  • Okta Workforce Identity Cloud
  • Custom IdP (configured via SAML or OpenID Connect)
The following SCIM providers are NOT supported:
  • PingFederate
  • Google Workspace
  • Active Directory Federation Services (ADFS)
  • Active Directory/LDAP

​
Configure SCIM User Provisioning in Your Identity Provider

When CData Support enables SCIM for your account, they provide a unique SCIM endpoint URL and Bearer token. Use these credentials to connect your identity provider to Connect AI. The steps below walk through the full SCIM user configuration for Microsoft Entra ID and Okta Workforce Identity Cloud.
Connect AI does not appear in the Entra application gallery. Create a new application from the gallery.
1
From the Microsoft Entra admin center, navigate to Enterprise apps > + New application. Click Create your own application, enter a name for the application (for example, Connect AI SCIM), select Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.
2
In the navigation menu, under Manage, select Properties. Set Assignment required to Yes and click Save.
3
In the navigation menu, under Manage, select Users and groups. Assign the users and groups you want to provision to Connect AI. When you assign a group, the users from that group are provisioned automatically.
4
In the navigation menu, under Manage, select Provisioning and click Get started.
5
Set Provisioning Mode to Automatic.
6
Under Manage, select Connectivity and configure the following parameters:
  • Tenant URL—enter the SCIM endpoint URL provided by CData Support and append ?aadOptscim062020 to the end of the URL. This is Microsoft’s recommended workaround for a known SCIM 2.0 issue.
  • Secret Token—enter the Bearer token provided by CData Support.
Click Test Connection.
7
Under Manage, select Attribute Mapping, then select the Users tab. In the row containing mail and emails[type eq "work"].value, click the Edit icon and configure the following:
  • Set Match objects using this attribute to Yes.
  • Set Matching precedence to 2.
Click Apply to save, then click Save on the Attribute Mapping page.
If users in your organization do not have the mail attribute populated in Entra ID, edit the same row and change Source attribute to userPrincipalName to ensure the email field is always populated during provisioning.
8
On the main Enterprise application page, select Provision on demand. Search for and select a user you assigned, then click Provision. Verify that the user appears in Connect AI.
9
Under Provisioning, set Provisioning Status to On to begin provisioning all assigned users and groups.

​
Direct API Provisioning, Updates, and Deprovisioning

In addition to IdP-based provisioning, you can manage users directly via the SCIM API. CData Support supplies a unique base URL following this format: https://{your-domain.com}/scim/v2. The URL endpoint contains the necessary user metadata. All SCIM endpoints require an Authorization header with a Bearer token. To provision a new user, POST to your unique SCIM endpoint. The system provisions the user in Connect AI. There is no need for the user to verify via email. The new user has a default system role of Query user. See Roles for details on system roles. The new user only has access to connections that have user-defined credentials turned on. To update a SCIM user’s name and email, use PATCH with the SCIM endpoint. When a SCIM update user request comes in, the system updates the information in Connect AI. To delete a user, use DELETE and your unique SCIM endpoint. The SCIM delete event calls the delete endpoint. For complete deprovisioning, also call DELETE /users/{id} from the Management API to revoke PATs and any direct role and permission grants. The Connect AI Audit Log displays SCIM user provisioning, updates, and deletions.

​
Roles and Permissions

A user’s access in Connect AI is the combination of group-derived roles (from SCIM group assignments), direct role assignments, and direct resource permissions. You can manage direct assignments and fully deprovision users using the Management API (base path /api/v1/): See Roles for details on system and access roles.