# Provision people with SCIM

Let your identity provider add people to your organization, and remove them when they leave.

*Cloud only:*

Not on GoRunner Cloud yet: the page says **Not on GoRunner Cloud yet.** To ask about it, write to [GoRunner](https://gorunner.io/contact).

*Embed only:*

Not in the Embed: your provider adds and removes your people.

*Self-hosted only:*

## You need

- **An owner**: Of the organization, to make, rotate or revoke the token. An admin can read the page: it says **Only an owner of this organization can issue a provisioning token.**
- **A license with SCIM**: Licenses come from GoRunner on request.
- **An identity provider with SCIM 2.0**: Such as Okta or Microsoft Entra.

## Connect your identity provider

1. Open **Settings**. Under **Organization**, open **Single sign-on** and go to **Provisioning (SCIM)**.
2. Copy the **SCIM base URL**. In Okta it goes in **Provisioning › Integration**; in Microsoft Entra, in **Provisioning › Tenant URL**.
3. Press **Generate token**, copy the **SCIM token**, and press **Done**. It isn’t shown again.
4. Paste the token into your identity provider, and turn its provisioning on.

![Provisioning (SCIM): the SCIM base URL with Copy, and Connected, made today, with Rotate token… and Revoke….](https://docs.gorunner.io/img/build/scim-panel-light.jpg)

You should see the panel says **Connected** and the day the token was made.

## What your identity provider can do

- **Add a person**: Creates the account as a member of the organization, and an editor in its first workspace by name. Each takes a seat. At the license’s seat limit, new people are refused, and your provider shows why.
- **Deactivate or remove**: Removes them from the organization and its workspaces. Their account stays. Their API tokens there end, and so do the invitations they sent that are still open. Reactivating adds them back as a member, and as an editor in the first workspace by name. Their earlier workspace roles aren’t restored.
- **An owner**: Your provider can’t remove the person who owns the organization, or its last owner: it gets a `403` that says so. Hand the organization over or name another owner first. Any other owner goes as anyone does.
- **Rename**: Changes the person’s name, when the organization holds their account.

Groups aren’t provisioned: give workspaces and roles in GoRunner. An address that already has an account of its own, outside your organization, is refused.

Each change is in the [audit log](https://docs.gorunner.io/build/audit-log) as **Person provisioned (SCIM)**, **Person updated (SCIM)** or **Person deprovisioned (SCIM)**.

## Rotate or revoke the token

- **Rotate token…**: Makes a new token. The old one stops at once, so update your identity provider right after.
- **Revoke…**: Your identity provider stops adding and removing people. Nobody loses access. You can revoke even without a license.

**What if the license ends?**

Single sign-on and SCIM stop at once. People already provisioned keep their access. Without the feature, your provider’s calls are refused with **SCIM provisioning requires an enterprise license**.

## For developers

The base URL ends in `/api/scim/v2`. Your provider calls `/Users` with the token as `Authorization: Bearer`, in `application/scim+json`. It may list with `filter=userName eq "…"` or `externalId eq "…"`, and deactivates with `PATCH` on `active`.

## Related

- [Set up single sign-on](https://docs.gorunner.io/build/single-sign-on): Sign in through your identity provider · 5 min
- [Invite people and set roles](https://docs.gorunner.io/build/invite-people): Members and People · 4 min
- [Your license](https://docs.gorunner.io/self-host/license): What your license includes · 4 min

Source: https://docs.gorunner.io/build/scim