SCIM User Provisioning

Overview

Entri supports SCIM 2.0 so your identity provider can manage who has access to the Entri dashboard. Once connected, assigning a user to the Entri application in Okta, Microsoft Entra ID, or any other SCIM 2.0 client creates their dashboard account, and unassigning them removes it. SCIM is available on plans that include enterprise SSO.

What SCIM does

Action in your identity provider	Result in Entri
Assign a user to the Entri application	A dashboard user is created with the Analyst role. No invitation email is sent. The user signs in through SSO.
Change the user’s email address	The dashboard user’s email is updated.
Unassign or deactivate the user	The dashboard user is deleted. Reassigning the user creates a new account with the Analyst role.
Delete the user	The dashboard user is deleted.

Roles and permissions are not synced through SCIM. Every provisioned user starts as an Analyst. An Entri admin changes roles in the dashboard after the user is created. Role, group, and custom attributes sent by your identity provider are ignored.

Groups are not supported. Only the User resource is available, so group push has no effect. Deactivating a user removes the account rather than suspending it, and there is no inactive state.

Setup

Copy your SCIM credentials from the Entri dashboard

Open the SCIM settings in the Entri dashboard and copy the SCIM base URL and the bearer token. The token is shown in full, so store it somewhere safe.

Create a SCIM integration in your identity provider

Add a SCIM 2.0 provisioning integration for Entri and paste the base URL and token. Authentication is an HTTP bearer token sent in the Authorization header.

Map attributes

Map the attributes listed below and leave all others unmapped. Enable provisioning for create, update, and deactivate.

Assign users

Assign users or groups to the Entri application. Each user appears in the Entri dashboard once your identity provider runs its next sync.

The bearer token expires 180 days after it is generated. Generate a new token in the Entri dashboard before it expires and update your identity provider. Requests with an expired token fail with 403.

Attribute mapping

Entri reads three attributes from each user.

SCIM attribute	Required	Entri field
`userName`	Yes	The user’s email address, used to sign in.
`emails[type eq "work"].value`	No	The same email address as `userName`.
`active`	No	Setting this to `false` deletes the user.

Endpoints

The base URL is https://api.goentri.com/integration/scim/v2.

Method	Path	Notes
`GET`	`/Users`	Supports `filter=userName eq "email"`, `startIndex`, and `count`. Maximum `count` is 100.
`POST`	`/Users`	Returns `400` if the email already belongs to a user in your organization.
`GET`	`/Users/{id}`	Returns a single user.
`PUT`	`/Users/{id}`	Updates `userName` and `active`.
`PATCH`	`/Users/{id}`	Supports `replace` and `add` operations on `userName`, `emails`, and `active`.
`DELETE`	`/Users/{id}`	Returns `204`.
`GET`	`/ServiceProviderConfig`	Describes supported features. Bulk operations, sorting, ETags, and password changes are not supported.
`GET`	`/ResourceTypes`	Lists the User resource type.
`GET`	`/Schemas`	Returns the User schema.

Troubleshooting

Symptom	Cause
Every request returns `403`	The token has expired or was regenerated. Copy the current token from the dashboard into your identity provider.
Assignment fails with `User already exists`	The email already belongs to a dashboard user in your organization. Remove the existing user in the dashboard, or unassign and reassign the user in your identity provider.
A user was created with the wrong role	Expected. Roles are set in the dashboard, not by SCIM.
A deactivated user is missing from the dashboard	Expected. Deactivation deletes the account.

Get Started

Activate Suite

Domain Management

SSL Provisioning

For DNS Providers

DNS Concepts

Entri MCP

Reference

Legal & Security

Resources

SCIM User Provisioning

Overview

What SCIM does

Setup

Attribute mapping

Endpoints

Troubleshooting

​Overview

​What SCIM does

​Setup

​Attribute mapping

​Endpoints

​Troubleshooting

Overview

What SCIM does

Setup

Attribute mapping

Endpoints

Troubleshooting