SCIM

With SCIM 2.0 your identity provider keeps the member list in step with yours: people are created when they join, updated when they change role and deactivated when they leave. Groups come across too, and can then be given courses.

SCIM works with or without SSO. Check that your identity provider plan includes automatic provisioning.

Connect your identity provider

1. As an organization admin, go to Admin → Settings → User sync (SCIM), name the key (for example "Okta") and create it.
2. Copy the address and the secret key. The key is shown only once. If you lose it, create a replacement.
3. Paste both into your identity provider.

Anyone holding the key can read and change your member list. Revoke a key from the same page; the next call that uses it fails. Each key shows when it was last used.

Okta

1. In the application, open Provisioning → Configure API Integration and enable it.
2. Paste the address and the key, choose Test API Credentials, then save.
3. Under To App, enable Create Users, Update User Attributes and Deactivate Users.
4. Assign people, and use Push Groups for the groups you want in SceneSnap.

Microsoft Entra ID

1. In the enterprise application, open Provisioning and set the mode to Automatic.
2. Paste the address and the key, choose Test Connection, save and start provisioning.

Before you start, map externalId to a stable identifier such as objectId. Avoid an email address or nickname that can change when an account is renamed.

What SceneSnap supports

Not supported: bulk operations, sorting, ETags, and filters other than eq. SCIM does not provision sign-in passwords. Do not send passwords or other secrets as user attributes.

How members behave

• Delete deactivates. A deleted user is deactivated, never erased, so a later SSO or LMS launch cannot bring them back. Deleted groups are removed.
• Every user needs an email address. SceneSnap reads it from emails, or from userName when there is none, and refuses a user without one: the address is how the person's first sign-in reaches their membership.
• Existing memberships can be reused. A new user is matched first on externalId, then on email. Pending invitations keep the role they were sent with. A provisioned user who has not signed in yet joins at the first sign-in that confirms their address, as described in Add members.
• The identity provider owns the lifecycle. Once a member is linked to SCIM, their activation and deactivation happen only in the identity provider. The dashboard marks them Managed by SCIM.
• Roles stay in SceneSnap. SCIM does not set who is an admin.
• Groups from the identity provider are read only in SceneSnap, since the next sync would undo any edit.
• Attributes are retained. SceneSnap uses department, job title, employee number and manager, and retains other supplied user attributes. Send only the attributes your organization needs.

Data exchanged

Your identity provider sends user identifiers, email addresses, activation status, optional profile attributes, group names and group membership. SceneSnap returns user and group records in provisioning responses, including their SceneSnap identifiers, status and membership information. User records can include other attributes your provider previously sent.

The connection is scoped to your organization. SCIM does not return learning content or quiz results. It does not assign licenses; see Licenses.

Deleting a group removes course access granted through that group. Members remain in your organization, and any access they have through other shares remains.

Troubleshooting