SSO & Identity

SCIM provisioning: sync users from your identity provider

SSO signs people in with an existing account; SCIM goes one step further and lets your identity provider manage the account itself. Assign someone to the app in Microsoft Entra ID or Okta and they show up in DMARCS automatically. Unassign them and they're removed the same way, without anyone in your team having to remember to do it by hand.

Where to find it

Organization → Integrations → SCIM Provisioning

Who can use it

Organization Admin

Time needed

10 minutes

You will need

Admin access to your identity provider's provisioning settings (Microsoft Entra ID or Okta)

Before you start

SCIM provisioning is separate from SSO login and works alongside it. A person can still only be provisioned with an email on one of your organisation's verified domains, the same rule that applies to inviting someone by hand. If your identity provider assigns someone with an email on a domain you haven't verified in DMARCS, the request is rejected and shows up as a failed attempt in the provisioning log at the bottom of the page.

Set it up

1. Generate a SCIM token

   On the SCIM Provisioning page, click Generate token. You'll get a Tenant URL and a Secret Token; copy both now. The token is shown once and can't be retrieved again. If you lose it, click Rotate token to generate a new one (this invalidates the old one immediately, so update your identity provider at the same time).

2. Connect your identity provider

   The exact screen differs by provider, but every one of them asks for the same two values:

   Values your identity provider needs

   Tenant URL

   https://your-domain.com/api/scim.php/v2

   Secret Token

   the value shown once when you generated it

   In Microsoft Entra ID, open the app under Enterprise Applications, go to Provisioning, and set Provisioning Mode to Automatic. Paste in the Tenant URL and Secret Token and click Test Connection; it should succeed immediately. Assign the users or groups who should have DMARCS access, then set Provisioning Status to On.

   In Okta, open your app, go to the Provisioning tab, and click Configure API Integration. Check Enable API integration, paste the Tenant URL in as the Base URL and the Secret Token as the API Token, then click Test API Credentials. Once that's confirmed, enable Create Users, Update User Attributes and Deactivate Users under Provisioning to App, and assign the people who should get access.

3. Confirm it's working

   Assign one person as a test. Within a minute or two they should appear in Organization → Team Management, marked with a small SCIM badge. Unassign them and they disappear from the active list; they'll show up instead in the Deleted Users tab on that same page, so you can always see who was removed and when.

Manual provisioning, without an identity provider

If the identity provider you use doesn't support SCIM, or you just want to add one person without waiting on IT, the SCIM Provisioning page has its own Manual Provisioning panel: enter an email, name and role and click Provision. It runs through the same checks a real identity-provider push does, domain verification and no duplicate accounts, and the same panel lets you edit or deactivate any existing user. Unlike an automatic push, manual provisioning lets you choose the role (Viewer or Organization Admin) up front.

The provisioning log

Every provisioning event for your organisation is recorded in the log at the bottom of the SCIM Provisioning page: accounts created, updated or deactivated from either your identity provider or the manual panel, and rejected attempts too (a duplicate email, an unverified domain, a user that no longer exists). If a person you assigned in Entra ID or Okta isn't showing up in DMARCS, this is the first place to check.