Every entry below is documented provider behavior, not conformance lore: the vendor's own pages, retrieved and dated. Seven providers carry deep sections (Microsoft Entra ID, Okta, Google Workspace, AWS IAM Identity Center, Slack, GitHub Enterprise Managed Users, Atlassian); the other seven carry the documented highlights. Where a provider's documentation does not state a behavior, the entry says so instead of guessing; the date on each row is when the source page was accessed (Okta ground truths were verified against the same pages on 2026-10-11). The error decoder renders the provider-verbatim error strings from the same dataset.
One pattern is worth naming before the entries: Entra's provisioning service emits a default dialect of its own - capitalized PATCH operations, the boolean active serialized as a string, and member removals sent as value arrays - and independent vendors document their products around that behavior. Three of them attest it in their own product surfaces:
| Vendor surface | What it documents | Source |
|---|---|---|
| JumpCloud | The Entra integration's documented tenant URL appends the ?aadOptscim062020 compatibility flag; EU tenants point at api.eu.jumpcloud.com with the same flag. | JumpCloud requires the aadOptscim062020 flag for Entra, accessed 2026-11-01 |
| WorkOS | Directory Sync, an entire product, exists to absorb the divergence: "Each directory provider implements SCIM differently." | WorkOS Directory Sync exists because of the divergence, accessed 2026-11-01 |
| Datadog | SCIM support names exactly two identity providers, Entra and Okta: "Other identity providers may work, but are not explicitly supported." | Datadog supports only Entra and Okta, accessed 2026-11-01 |
Microsoft Entra ID
SCIM client (provisioning service pushing to apps) · deep depth
| Authentication | The endpoint must accept a single bearer token: a long-lived static secret configured in the Secret Token field. TLS 1.2 with an exact cipher-suite floor is required. Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 |
| Filters | Entra-only filtering uses the operators eq and and; queryable attributes must be configured as matching attributes. Users are queried on userName (and emails[type eq "work"].value where it is a uniqueness attribute); groups on displayName, which must additionally be unique. Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 |
| PATCH | Default mode emits capitalized op values (Add, Replace, Remove), serializes the boolean active as the string "False", and removes group members with a value array instead of a path filter. The compliant mode sits behind the tenant-URL flag aadOptscim062020. Entra SCIM compatibility known-issues page, published 2025-08-25, accessed 2026-11-01 |
| Lifecycle | Disable is a soft delete: active=false and the user must stay GET-able while inactive. Hard delete is DELETE /Users/{id} returning 204, exercised only when the app declares hard-delete support. Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 |
| Pagination | Listing and pagination (RFC 7644 Section 3.4.2.4) is a stated requirement; example responses use startIndex and itemsPerPage of 20. Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 |
| Bulk | Not supported: "we don't support SCIM /Bulk today". /Schemas discovery is supported for gallery apps only. Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 |
| Rate limits | Provisioning-service IP ranges are published under the AzureActiveDirectory service tag. Entra provisioning tutorial, accessed 2026-11-01 |
| Groups | Groups are optional and PATCH-only. Group GETs are expected to honor excludedAttributes=members; duplicate user or group POSTs must yield 409. Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 |
Documented quirks
- The compliant PATCH is still not the default: the known-issues row for "Update PATCH behavior to ensure compliance" reads Fixed? No, fix date TBD, as of the 2025-08-25 published page accessed 2026-11-01.
Entra SCIM compatibility known-issues page, published 2025-08-25, accessed 2026-11-01 - The aadOptscim062020 flag "currently doesn't work with on-demand provisioning", so validating a single user exercises different code paths than production sync.
Entra SCIM compatibility known-issues page, published 2025-08-25, accessed 2026-11-01 - Group creates may carry a legacy Microsoft group schema URI (http://schemas.microsoft.com/2006/11/ResourceManagement/ADSCIM/2.0/Group) alongside the core one, and extension attributes arrive in dot notation before the attribute name.
Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 - Complex attributes with three or more sub-attributes cannot be populated, and type sub-attribute values must be unique within each multi-valued attribute.
Entra SCIM compatibility known-issues page, published 2025-08-25, accessed 2026-11-01 - Values must be stored verbatim ("Transformations of data shouldn't happen") and Entra never sends null values: "If a value isn't present, don't send null values."
Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01 - The SCIM Validator requires HTTP 201 on the first create and 409 on an identical second create, and expects responses with content-Type: application/scim+json and an id on every returned resource.
Entra provisioning tutorial, ms.date 2026-09-15, accessed 2026-11-01
learn.microsoft.com · learn.microsoft.com
tutorial, ms.date 2026-09-15, accessed 2026-11-01; known issues, published 2025-08-25, accessed 2026-11-01
Okta
SCIM client (pushes to app SCIM servers) · deep depth
| Authentication | Per integration: OAuth 2.0 (authorization code with refresh tokens, refreshed only when SCIM operations run), Basic Auth, or a header token. developer.okta.com SCIM concepts and FAQs, accessed 2026-11-01 |
| Filters | User matching is GET /Users?filter=userName eq "{userName}"; "your SCIM server must support this specific filtering query parameter to provision users successfully." POST-based search and meta.lastModified filtering are unsupported. developer.okta.com SCIM FAQs, accessed 2026-11-01 |
| PATCH | PATCH is the default for OIN catalog templates; App Integration Wizard integrations are PUT-only and cannot be switched to PATCH. The active attribute is special-cased in both directions. developer.okta.com SCIM FAQs, accessed 2026-11-01 |
| Lifecycle | "Okta uses a soft delete model. Instead of sending a DELETE request, Okta updates the user resource with active=false." Deleting an already-deactivated user sends nothing to the app. developer.okta.com SCIM concepts, accessed 2026-11-01 |
| Pagination | startIndex, count, and totalResults must be supported. developer.okta.com SCIM FAQs, accessed 2026-11-01 |
| Bulk | Unsupported, as are /Me and /ServiceProviderConfig; /Schemas and /ResourceTypes appear only in the SCIM 2.0 entitlements variant. developer.okta.com SCIM FAQs, accessed 2026-11-01 |
| Rate limits | On HTTP 429 Okta pauses the task and honors Retry-After only when it is integer seconds; an HTTP-date or missing header defaults to a 5-minute wait, each subsequent failure doubles the wait, and after 10 attempts the task fails permanently. Servers must respond within 60 seconds or Okta closes the socket. developer.okta.com SCIM concepts and FAQs, accessed 2026-11-01 |
| Groups | /Groups is optional; Group Push is a supported provisioning operation and membership flows through app assignment. Custom attribute names must avoid reserved names such as groups. developer.okta.com SCIM concepts, accessed 2026-11-01 |
Documented quirks
- Reassigning a user to an app sets active=true downstream the first time, but profile pushes never update user status downstream, and Okta will not import users whose app-side status is active=false, even on full import.
developer.okta.com SCIM concepts, accessed 2026-11-01 - Base path is /scim/v2/, the base URL may not contain an underscore, id is server-assigned and case-sensitive, and bulkId is reserved.
developer.okta.com SCIM guides, verified 2026-10-11
Decode this provider's verbatim error string in the error decoder.
developer.okta.com · developer.okta.com
accessed 2026-11-01; accessed 2026-11-01
Google Workspace
SCIM client (Admin console auto-provisioning) · deep depth
| Authentication | Static bearer token only: "Supports Bearer Token authentication. OAuth token authentication is not supported." Token expiry or revocation stops syncing until re-authorization. Google Workspace custom SCIM profiles help, published 2026-10-29, accessed 2026-11-01 |
| Filters | Attribute mapping is discovered from the endpoint where schema discovery is supported. Google Workspace provisioning help, accessed 2026-11-01 |
| PATCH | Custom SCIM profile apps must support "standard HTTP methods, including POST, GET, PATCH with fallback to PUT, and DELETE." Test Connection creates a real user, updates it, and deletes it; if create does not return 201 the update and delete are skipped and a failed test delete strands the test account. Google Workspace custom SCIM profiles help, published 2026-10-29, accessed 2026-11-01 |
| Lifecycle | Per-app deprovisioning: suspend and/or hard delete after a chosen delay of within 24 hours, 1, 7, or 21 days, set independently for app-off, user-suspended, and user-deleted events; suspended maps to deactivated in the app. Google Workspace provisioning help, accessed 2026-11-01 |
| Pagination | Sync cadence: "Users are synced every few hours." Google Workspace provisioning help, accessed 2026-11-01 |
| Rate limits | Edition caps: 3 apps on Business/Frontline Starter, up to 100 on higher editions; custom SCIM profiles are a limited beta. Google Workspace provisioning help, accessed 2026-11-01 |
| Groups | Selecting Google groups as provisioning scope only limits which users are provisioned; it does not synchronize group membership into the app ("Google is still adding support for this in their SCIM provider", per Cloudflare's 2026-10-28 changelog). Google Workspace help accessed 2026-11-01; Cloudflare One changelog, 2026-10-28 |
Documented quirks
- Users from secondary domains or outside the organization are excluded from provisioning.
Google Workspace provisioning help, accessed 2026-11-01
knowledge.workspace.google.com · knowledge.workspace.google.com
published 2026-10-29, accessed 2026-11-01; published 2026-10-29, accessed 2026-11-01
AWS IAM Identity Center
SCIM server (receives provisioning from external IdPs) · deep depth
| Authentication | Static bearer token generated in the console; tokens are valid for exactly one year with escalating Health Dashboard and console rotation reminders starting 90 days out. The endpoint and token are shown only once at enablement. AWS IAM Identity Center user guide, accessed 2026-11-01 |
| Filters | Only eq, optionally combined with and, and only specific attribute combinations (users: userName, externalId, groups.value, id and manager; groups: displayName, externalId, members.value, id and member). AWS IAM Identity Center developer guide, accessed 2026-11-01 |
| PATCH | Ops add/replace/remove (lowercase); path is required for remove and value for add/replace. Remove is not allowed on userName or active; multi-valued attributes are restricted to a single value; ims, photos, x509Certificates, entitlements, and password are unsupported; PatchGroup supports neither remove-all nor replace. The official PatchUser example writes "value": "false" (a string) for active. AWS IAM Identity Center developer guide (PatchUser, limitations), accessed 2026-11-01 |
| Lifecycle | active=false via PATCH is supported; DELETE /Users/{id} deletes the user. Enabling SCIM locks manual user editing in the console, and mixing Identity Store API mutations with SCIM causes directory drift (AWS ships an SCP to deny them). AWS IAM Identity Center user guide, accessed 2026-11-01 |
| Pagination | Cursor-based, not SCIM offset paging: startIndex, attributes, and excludedAttributes are "not supported (despite being listed in the SCIM protocol)"; count maxes at 100 (default 100); the first page is requested with a bare cursor parameter; changing filter parameters between pages returns 400. AWS IAM Identity Center developer guide (ListUsers), accessed 2026-11-01 |
| Bulk | /Bulk, /Search, and /Me unsupported; /Schemas, /ResourceTypes, and /ServiceProviderConfig supported (ListSchemas/ListResourceTypes added February 7, 2024). AWS IAM Identity Center developer guide (supported APIs), accessed 2026-11-01 |
| Rate limits | SCIM write APIs 25 TPS, read APIs 40 TPS per Identity Store instance (increase via support case); "each individual membership operation in CreateGroup or PatchGroup calls counts as a transaction toward a separate membership operation throttle limit"; errors surface as 429 ThrottlingException. AWS IAM Identity Center user guide (limits), accessed 2026-11-01 |
| Groups | Groups are supported via POST/PATCH, but GetGroup and ListGroups always return an empty member list (find a user's groups with the members.value filter). A documented maximum-members-per-request constraint for CreateGroup exists (March 2022 doc history). AWS IAM Identity Center developer guide (limitations), accessed 2026-11-01 |
Documented quirks
- Attempts to synchronize multivalue attributes (multiple emails or phone numbers) into IAM Identity Center with SCIM fail by design.
AWS IAM Identity Center user guide, accessed 2026-11-01 - SCIM only syncs users assigned to the IdP application.
AWS IAM Identity Center user guide, accessed 2026-11-01
Decode this provider's verbatim error string in the error decoder.
docs.aws.amazon.com · docs.aws.amazon.com · docs.aws.amazon.com · docs.aws.amazon.com
accessed 2026-11-01; accessed 2026-11-01; accessed 2026-11-01; accessed 2026-11-01
Slack
SCIM server · deep depth
| Authentication | Bearer token (xoxp- user token with SCIM scopes, org-level administration); available to Business+ and Enterprise plans; token use can be restricted by IP allowlist (November 2023 changelog). docs.slack.dev SCIM API docs, accessed 2026-11-01 |
| Filters | A filter parameter exists on /Users and /Groups; userName eq searches are demonstrated. docs.slack.dev SCIM API docs, accessed 2026-11-01 |
| PATCH | SCIM 2.0 PATCH expects an Operations body with add, replace, remove. Several fields are not settable: group mention handles, auto-generated subteams (e.g. Team Admins), and Single-Channel Guest restrictions (provision as a full user, then restrict in the admin UI). docs.slack.dev SCIM API docs, accessed 2026-11-01 |
| Lifecycle | "Users can not be permanently deleted from Slack, they can only be deactivated." Provisioning a duplicate email fails "even if the existing user has been previously deactivated"; freeing the email requires a manual edit in Slack. docs.slack.dev SCIM API docs, accessed 2026-11-01 |
| Pagination | count is capped at 1000 (values above are evaluated as 1000, since July 8/August 30, 2019); default page size 10; startIndex paging. docs.slack.dev SCIM changelog 2019-06 "Have SCIM, will paginate" |
| Rate limits | Org-wide across all SCIM apps in the org, not per-app: writes 600 requests/minute (burst 180), reads 1000/minute (burst 1000); per endpoint, GET user or group 300/min, create/update/delete 180/min; 429 carries Retry-After. docs.slack.dev SCIM rate limits, accessed 2026-11-01 |
| Groups | /Groups (subteams) carries membership; subteams Slack auto-generates cannot be updated via SCIM (group update burst 80/min). docs.slack.dev SCIM API docs and rate limits, accessed 2026-11-01 |
Documented quirks
- One invalid custom profile field drops the entire profile: "if anything in custom profile is invalid, all profile fields will be dropped"; custom profile fields cap at 50 (overflow fails with unable_to_create_team_profile_fields), and addresses.type is used for primary selection but never stored.
docs.slack.dev SCIM API docs, accessed 2026-11-01 - Usernames and channel names share one namespace: a user @general cannot exist if #general exists.
docs.slack.dev SCIM API docs, accessed 2026-11-01 - A Slack custom schema exists at urn:ietf:params:scim:schemas:extension:slack:profile:2.0:User (e.g. startDate), alongside the enterprise user extension.
docs.slack.dev SCIM API docs, accessed 2026-11-01
Decode this provider's verbatim error string in the error decoder.
docs.slack.dev · docs.slack.dev
accessed 2026-11-01; accessed 2026-11-01
GitHub Enterprise Managed Users
SCIM server for EMU enterprises · deep depth
| Authentication | Personal access token (classic) with the scim:enterprise scope; GitHub recommends authenticating as the enterprise setup user; read-only consumers can use admin:enterprise for GETs. docs.github.com EMU SCIM reference, accessed 2026-11-01 |
| Filters | eq only, one filter at a time ("Multiple filters are not supported"); allowed attributes for users: userName, externalId, id, displayName; for groups: externalId, id, displayName. docs.github.com EMU SCIM reference, accessed 2026-11-01 |
| PATCH | Operations with add/replace/remove. The docs warn "Complex SCIM path selectors that include filters are not supported" (e.g. emails[type eq "work"]) while the same page's multi-valued example uses exactly that path; treat filtered paths as unreliable. PUT is full-replace: omitted group information, including membership, is removed. docs.github.com EMU SCIM reference, accessed 2026-11-01 |
| Lifecycle | PATCH active:false suspends the user and obfuscates their handle and primary email (metadata remains; they can rejoin). DELETE "suspends a SCIM user permanently": all data removed, login/email/display name anonymized, PATs, SSH keys, OAuth authorizations, GPG keys, and SAML mappings erased; irreversible. docs.github.com EMU SCIM reference, accessed 2026-11-01 |
| Pagination | startIndex (default 1) and count (default 30). docs.github.com EMU SCIM reference, accessed 2026-11-01 |
| Bulk | Group member batches can be sent as multiple operations in one PATCH. docs.github.com EMU SCIM reference, accessed 2026-11-01 |
| Rate limits | 429 is documented as a possible response. docs.github.com EMU SCIM reference, accessed 2026-11-01 |
| Groups | Groups carry members with value (required) and displayName (required) per member; "Ensure users are created before referencing them here"; a group PUT without members removes membership. docs.github.com EMU SCIM reference, accessed 2026-11-01 |
Documented quirks
- SAML/SCIM identity matching is mandatory: the Entra objectid claim must equal externalId, every other IdP's NameID must equal userName, and users must be SCIM-provisioned before first SAML sign-in.
docs.github.com EMU SCIM reference, accessed 2026-11-01 - roles.value accepts named roles (user, enterprise_owner, billing_manager, guest_collaborator) or opaque GUID role identifiers.
docs.github.com EMU SCIM reference, accessed 2026-11-01
docs.github.com
accessed 2026-11-01
Atlassian (Guard user provisioning)
SCIM server · deep depth
| Authentication | Directory-scoped SCIM API key as bearer, shown once at creation; regenerating immediately invalidates the old key, and "SCIM API keys expire one year after you create or regenerate them." Personal API tokens and org admin API keys do not work on these endpoints; user provisioning requires an Atlassian Guard Standard subscription. developer.atlassian.com user provisioning REST API; support KB updated 2025-04-02, accessed 2026-11-01 |
| Filters | "Filtering is supported with a single exact match (eq) against the userName and externalId attributes." Sorting is not supported. developer.atlassian.com user provisioning REST API, accessed 2026-11-01 |
| PATCH | PATCH on Users; PUT replaces "attribute-by-attribute... Existing values of unspecified attributes are cleaned" (partial PUTs erase data); userName is required on PUT/POST. developer.atlassian.com user provisioning REST API, accessed 2026-11-01 |
| Lifecycle | DELETE deletes the SCIM record ("no method to reverse these changes except by creating a new SCIM record"), unlinks the user from the IdP, and deactivates managed users; reactivation happens in Atlassian Administration. developer.atlassian.com user provisioning REST API, accessed 2026-11-01 |
| Pagination | startIndex/count; the support KB shows first-100 default paging and count=200 requests. Atlassian support KB, updated 2025-04-02, accessed 2026-11-01 |
| Rate limits | Platform-wide Atlassian rate limiting applies (429 documented on org APIs). developer.atlassian.com, accessed 2026-11-01 |
| Groups | Groups endpoints exist (create/get/update by ID). developer.atlassian.com API TOC, accessed 2026-11-01 |
Documented quirks
- The updatable user field set is fixed (displayName, emails, organization, title, timezone, department, preferredLanguage); duplicate create returns 409; creating a user whose email matches an existing Atlassian platform account links the accounts.
developer.atlassian.com user provisioning REST API, accessed 2026-11-01
developer.atlassian.com
accessed 2026-11-01
Zoom
SCIM server (SCIM2 API) · summary depth
| Authentication | OAuth 2.0 only: an OAuth app or Server-to-Server OAuth app with the SCIM2 scope (granular scope scim2:admin); per Microsoft's gallery tutorial Zoom no longer supports plain bearer auth. developers.zoom.us SCIM2 reference; Entra Zoom tutorial, accessed 2026-11-01 |
| Filters | Exactly two documented filters on List users: userName eq {userEmail} and externalId eq {userId}; anything else returns 400 "The current filter is not supported." developers.zoom.us SCIM2 reference, accessed 2026-11-01 |
| PATCH | PATCH /scim2/Users/{userId} is documented as the deactivate operation; PUT for full update; Accept: application/scim+json expected. developers.zoom.us SCIM2 reference, accessed 2026-11-01 |
| Lifecycle | Both exist: PATCH deactivate and DELETE /Users/{userId}. developers.zoom.us SCIM2 reference, accessed 2026-11-01 |
| Pagination | startIndex (default 1) plus count; the reference documents a count default of 1; totalResults and itemsPerPage are returned. developers.zoom.us SCIM2 reference, accessed 2026-11-01 |
| Rate limits | Zoom's standard rate-limit tier labels apply per endpoint (List users = MEDIUM, Create = LIGHT); numeric limits live in the general rate-limits reference. developers.zoom.us SCIM2 reference, accessed 2026-11-01 |
| Groups | Group resource plus groups on user create; a user roles array is supported. developers.zoom.us SCIM2 reference, accessed 2026-11-01 |
Documented quirks
- SCIM requests fail with 400 "Account has not enabled Single Sign-On" unless the account has SSO enabled (prerequisites: Owner/Admin role, Business or Education account with approved vanity URL).
developers.zoom.us SCIM2 reference, accessed 2026-11-01 - The userType field is planned for deprecation, and the "Collaboration" value "is not supported with Microsoft Entra due to a Microsoft-specific limitation" while working with Okta and direct API calls.
developers.zoom.us SCIM2 reference, accessed 2026-11-01 - A Zoom custom schema exists at urn:us:zoom:scim:schemas:extension:1.0:ZoomUser (loginType sso/workEmail), alongside the enterprise extension.
developers.zoom.us SCIM2 reference, accessed 2026-11-01
Decode this provider's verbatim error string in the error decoder.
developers.zoom.us
accessed 2026-11-01
Salesforce
SCIM server (Identity SCIM API on My Domain) · summary depth
Documented quirks
- Official Help articles resisted automated retrieval (the Lightning shell returns no content), so this entry carries no endpoint detail at verified grade; lead-grade items were removed on 2026-11-02.
retrieval note, 2026-11-01; certainty pass 2026-11-02 (lead)
help.salesforce.com
URL located 2026-11-01; content not retrievable by automation
Datadog
SCIM server · summary depth
| Authentication | A Datadog application key secures the connection; a dedicated service account is strongly recommended because a user-owned key is revoked when that user is deprovisioned, permanently breaking the integration. docs.datadoghq.com SCIM, accessed 2026-11-01 |
| PATCH | Roles follow the RFC 7643 multi-valued roles convention: "When a SCIM request includes one or more roles, Datadog provisions only the roles that match a role in your organization. If none of the roles match, the user falls back to your organization's default role"; unmatched roles are logged to Audit Trail. docs.datadoghq.com SCIM, accessed 2026-11-01 |
| Lifecycle | Deprovisioning "removes users in Datadog when they no longer require access". docs.datadoghq.com SCIM, accessed 2026-11-01 |
| Groups | Managed teams: IdP groups become Datadog Teams with membership synchronized. docs.datadoghq.com SCIM, accessed 2026-11-01 |
Documented quirks
- Role provisioning takes precedence over SAML role mappings, and SAML JIT provisioning should be disabled when SCIM is on. Supported IdPs are explicitly Microsoft Entra ID and Okta ("Other identity providers may work, but are not explicitly supported"); plan gating: Infrastructure Pro, Infrastructure Enterprise, Startup.
docs.datadoghq.com SCIM, accessed 2026-11-01
docs.datadoghq.com
accessed 2026-11-01
JumpCloud
both directions (SCIM server for imports, SCIM client via connectors) · summary depth
| Authentication | Inbound uses a JumpCloud admin API key in the x-api-key header ("Currently, the API token doesn't expire"); outbound connectors take the SP's token; optional mTLS. jumpcloud.com support pages, accessed 2026-11-01 |
| PATCH | SCIM 1.1 reached end of support in November 2025: existing integrations keep running until manually deactivated but cannot be updated or created. jumpcloud.com support pages, accessed 2026-11-01 |
| Lifecycle | Connector tests "delete the test user if DELETE is supported... If the DELETE method is not supported for users, then the test user will be deactivated"; export deprovisioning fires when bindings are removed or the user is suspended or deleted. jumpcloud.com support pages, accessed 2026-11-01 |
| Groups | Inbound: "Real-time Group import isn't currently supported." Outbound: optional group-management toggle; export is binding-driven and asynchronous. jumpcloud.com support and docs.jumpcloud.com guide, accessed 2026-11-01 |
Documented quirks
- The Entra-specific guide appends ?aadOptscim062020 to the tenant URL (EU tenants: api.eu.jumpcloud.com).
jumpcloud.com Entra provisioning guide, accessed 2026-11-01 - Only ACTIVATED bound users export; STAGED users stay bound locally but are skipped for SCIM export, and imported users land in pending-password state with no automatic activation email.
docs.jumpcloud.com user-provisioning guide, accessed 2026-11-01
jumpcloud.com
accessed 2026-11-01
OneLogin
SCIM client (SCIM Provisioner) · summary depth
| Authentication | SCIM Bearer Token configured in the app: "This token authenticates requests and responses sent between the OneLogin SCIM provisioning service and your SCIM server." developers.onelogin.com SCIM docs, accessed 2026-11-01 |
| Filters | Catalog connectors implement per-app SCIM behavior. developers.onelogin.com SCIM docs, accessed 2026-11-01 |
Documented quirks
- Supports SCIM 1.1 and 2.0 depending on the connector.
developers.onelogin.com SCIM docs, accessed 2026-11-01
developers.onelogin.com
accessed 2026-11-01
Rippling
SCIM client (HR-driven outbound provisioning) · summary depth
| Authentication | Bearer token is the documented authorization method in Rippling's custom SCIM app form. WorkOS Rippling integration guide, accessed 2026-11-01 |
| PATCH | The connector form exposes feature toggles that shape requests: Supports groups, Supports pagination, Create & Delete Groups, Use PATCH to edit Groups, Generate temporary password, Use email address as username, and a "Supported SCIM Attributes" allowlist (externalId, emails.primary, name.givenName, name.familyName documented by WorkOS). WorkOS Rippling integration guide, accessed 2026-11-01 |
| Pagination | Feature-flag dependent per connector (form toggle). WorkOS Rippling integration guide, accessed 2026-11-01 |
| Groups | Optional per connector (the "Supports groups" toggle in the connector form). WorkOS Rippling integration guide, accessed 2026-11-01 |
Documented quirks
- Rippling's developer platform documents its separate REST API with bearer API tokens that auto-revoke when the owner is terminated or the token is unused for 30 days.
developer.rippling.com API tokens, accessed 2026-11-01
workos.com
accessed 2026-11-01
WorkOS Directory Sync
SCIM aggregation middleware serving normalized APIs to apps · summary depth
| Authentication | Per-directory bearer token and WorkOS-provisioned Endpoint URL ("Both of these are available in your Endpoint's Settings in the WorkOS Dashboard"); custom endpoint URLs available via support. workos.com Directory Sync docs, accessed 2026-11-01 |
| Filters | Not applicable downstream: the app consumes WorkOS Directory APIs, not SCIM. WorkOS absorbs IdP-side quirks: "Each directory provider implements SCIM differently." workos.com Directory Sync docs, accessed 2026-11-01 |
| PATCH | Not applicable downstream (normalized APIs). workos.com Directory Sync docs, accessed 2026-11-01 |
| Lifecycle | Deprovisioning surfaces to the app as directory user lifecycle events delivered via webhooks or the Events API; per-provider deprovision semantics remain the IdP's. workos.com Directory Sync docs, accessed 2026-11-01 |
| Pagination | Via WorkOS list APIs (not SCIM paging). workos.com Directory Sync docs, accessed 2026-11-01 |
| Bulk | Not applicable downstream. workos.com Directory Sync docs, accessed 2026-11-01 |
| Rate limits | WorkOS publishes platform rate limits. workos.com Directory Sync docs, accessed 2026-11-01 |
| Groups | Directory groups are first-class normalized objects; per-IdP caveats remain visible upstream (e.g. Google scoping does not carry group membership). workos.com Directory Sync docs, accessed 2026-11-01 |
Documented quirks
- Directory Sync exists because of this almanac: "Implementing SCIM is often a challenging process and can introduce security vulnerabilities into your app. Directory Sync hides this complexity."
workos.com Directory Sync docs, accessed 2026-11-01
workos.com
accessed 2026-11-01
Normative - the protocol the entries deviate from:
- RFC 7644: SCIM Protocolthe wire contract (methods, PATCH, pagination, errors); retrieved 2026-11-01
- RFC 7643: SCIM Core Schemathe data model the attribute quirks bend; retrieved 2026-11-01
Secondary - the provider documentation behind every entry, each dated in place above:
- learn.microsoft.com, learn.microsoft.com, developer.okta.com, developer.okta.com, knowledge.workspace.google.com, knowledge.workspace.google.com, docs.aws.amazon.com, docs.aws.amazon.com, docs.aws.amazon.com, docs.aws.amazon.com, docs.slack.dev, docs.slack.dev, developers.zoom.us, docs.github.com, developer.atlassian.com, help.salesforce.com, docs.datadoghq.com, jumpcloud.com, developers.onelogin.com, workos.com, workos.comall pages accessed 2026-11-01 (Okta ground truths verified 2026-10-11); Salesforce detail is lead-grade, sourced from connector vendors and a mirror of official curriculum, and no claim is made either way about Salesforce edition gating