<a id="scim-user-provisioning"></a>

# SCIM User Provisioning on Confluent Cloud

System for Cross-domain Identity Management
([SCIM](https://datatracker.ietf.org/doc/html/rfc7644)) user
provisioning is an industry-standard protocol that automates the
exchange of user identity information between your identity provider
(IdP) and Confluent Cloud. With SCIM, your IdP becomes the single source of
truth for Confluent Cloud user accounts, automating provisioning and
de-provisioning.

#### NOTE
SCIM-based user provisioning is generally available with the
[Advanced Security add-on](../../../../advanced-security.md#advanced-security-add-on). To enable the add-on,
an [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) must turn it on for your
organization.

The Advanced Security add-on is a Limited Availability feature in Confluent Cloud.
For details about included capabilities, limits, and billing, see
[Advanced Security add-on for Confluent Cloud](../../../../advanced-security.md#advanced-security-add-on).

When you add, update, or deactivate a user in your IdP,
Confluent Cloud syncs the change on a schedule determined by your IdP.
This reduces administrative overhead and helps you meet security and
compliance requirements by ensuring that former employees no longer
have access to Confluent Cloud after you remove them from your IdP.

SCIM syncs the following user attributes from your IdP to Confluent Cloud:

* Email address
* Name

#### IMPORTANT
When SCIM user provisioning is enabled, SCIM takes precedence for
managing single sign-on (SSO) user accounts, and you can no longer
invite SSO users from Confluent Cloud. Provision all new SSO user accounts
through your IdP.

Enabling SCIM does not automatically turn off [just-in-time (JIT)
user provisioning](jit-user-provisioning.md#jit-user-provisioning). If both are enabled, a user
who signs in with SSO can still be provisioned through JIT. To make your
IdP the sole source of new SSO user accounts, turn off JIT user
provisioning. For more information, see
[Disable JIT user provisioning](jit-user-provisioning.md#disable-jit-user-provisioning).

<a id="scim-how-it-works"></a>

## How SCIM syncs users

Enable SCIM for your SSO identity provider and configure the
connection in your IdP. Confluent Cloud manages user accounts through
the SCIM protocol based on actions in your IdP:

* When you assign a user to the Confluent Cloud application in your IdP, Confluent Cloud
  provisions a matching [single sign-on user account](../../user-accounts/manage-sso-user-accounts.md#single-sign-on-accounts).
* When you update a user’s first or last name in the Confluent Cloud application in
  your IdP, Confluent Cloud syncs the updated name to the corresponding user account.
* When you deactivate or remove a user from the Confluent Cloud application in your
  IdP, Confluent Cloud de-provisions the corresponding user account.

[Local user accounts](../../user-accounts/manage-local-user-accounts.md#local-user-accounts) are not affected by
SCIM. You can still create and manage local users in Confluent Cloud.

<a id="scim-prerequisites"></a>

## Prerequisites

* The [Advanced Security add-on](../../../../advanced-security.md#advanced-security-add-on) is turned on
  for your Confluent Cloud organization.
* SSO is set up for your Confluent Cloud organization. The SCIM option is not
  available until SSO is configured. For more information, see
  [Enable SAML SSO on Confluent Cloud](enable-sso.md#enable-sso).
* At least one [trusted domain](trusted-domains.md#manage-trusted-domains) is verified for
  your Confluent Cloud organization. Verifying a domain mitigates the risk of user
  impersonation. SCIM user provisioning and de-provisioning operations require
  the user’s email domain to be verified.
* Only users granted the [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role)
  role can enable SCIM and manage SCIM tokens.
* An IdP that supports SCIM 2.0, such as Okta or Microsoft Entra ID.

  #### NOTE
  Some IdPs, such as Google Workspace, support SCIM 2.0 only for a curated
  list of third-party applications in their application catalog. Okta and
  Microsoft Entra ID are tested with Confluent Cloud SCIM provisioning.

<a id="scim-enable"></a>

## Enable SCIM and generate a SCIM token

A SCIM token authenticates your IdP requests to the Confluent Cloud SCIM
endpoints. To connect your IdP to Confluent Cloud, enable SCIM for your SSO
identity provider and generate a SCIM token.

1. In the Confluent Cloud Console, go to the **Single sign-on** page at
   [https://confluent.cloud/sso](https://confluent.cloud/sso), or select **Single sign-on** in the
   navigation menu.
2. With SSO enabled, turn on the **SCIM** toggle for your SSO identity
   provider.
3. Generate a SCIM token and set an expiration time for the token.

   The default expiration is six months. The minimum expiration is one month,
   and the maximum expiration is two years.
4. Copy the SCIM token and the SCIM base URL.

   The SCIM base URL uses the following format, where `<sso_identifier>` is
   the identifier for your organization:
   ```text
   https://api.confluent.cloud/scim/v2/sso/<sso_identifier>
   ```

   The SCIM base URL is the same for every SCIM token in your organization.

   #### IMPORTANT
   The SCIM token is shown only once when it is generated. Copy and store
   it in a secure location. If you lose the token, delete it and generate a
   new one.
5. After you generate the SCIM token, provide the token and the SCIM base URL to
   the administrator who configures SCIM provisioning in your IdP. To configure
   SCIM in your IdP, refer to the documentation for your IdP:
   * [Okta](https://help.okta.com/oie/en-us/content/topics/provisioning/lcm/lcm-manage-users.htm)
   * [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups)

   Confluent Cloud uses the `userName` attribute as the unique identifier for SCIM
   users. When you configure SCIM in your IdP, make sure that `userName` maps
   to the email address that you want to use for the Confluent Cloud user account:

   ### Okta

   In Okta, update your SCIM connection settings:
   1. For the **Unique identifier field for users**,
      type in “email”.
   2. Enable **Push New Users** and **Push Profile Updates**.
   3. Set the **Authorization Mode** to `HTTP Header`.
   4. Enter the authentication token from your SCIM token file.
   5. Test and save your connector configuration.

   ### Microsoft Entra ID

   In Microsoft Entra ID, update your SCIM connection settings:
   1. Select your Confluent Cloud application, and then select
      **Manage** > **Provisioning** > **Connect your application**.
   2. Select **Bearer authentication** as your authentication method.
   3. For your **Tenant URL**, enter the base URL from your SCIM token file.
   4. For your **Secret token**, enter the authentication token from
      your SCIM token file.
   5. Test and save your connector configuration.

   #### IMPORTANT
   SCIM can only provision users whose email domain is verified as a
   [trusted domain](trusted-domains.md#manage-trusted-domains) for your Confluent Cloud
   organization.

   If your provisioning attempt fails with a `Forbidden` error, verify the user’s email
   is correct and that the domain is verified for your Confluent Cloud organization.
   For more information, see [Manage Trusted Domains on Confluent Cloud](trusted-domains.md#manage-trusted-domains).

   Verify the attribute mapping in the provisioning settings of your
   IdP so that the Confluent Cloud `userName` attribute maps to the user’s `email` or `mail`
   attribute. After you update the mapping, retry provisioning.

<a id="scim-rotate-tokens"></a>

## Rotate and delete SCIM tokens

Confluent Cloud notifies you by email before a SCIM token expires so that you
can rotate the token before it expires and avoid disruption to SCIM
provisioning.

You can have up to two active SCIM tokens at a time.

To rotate a SCIM token without disrupting provisioning:

1. Generate a second SCIM token. For more information,
   see [Enable SCIM](#scim-enable).
2. Update the token in your IdP configuration.
3. Delete your old SCIM token on the **Single sign-on** page in the
   Confluent Cloud Console.

After you delete a token, any IdP configured to use that token can
no longer authenticate to the Confluent Cloud SCIM endpoints.

<a id="scim-disable"></a>

## Disable SCIM

If you disable SCIM, Confluent Cloud revokes all active SCIM tokens and stops your IdP
from provisioning or de-provisioning Confluent Cloud user accounts through
SCIM. Confluent Cloud does not remove existing user accounts when you turn
off SCIM.

1. In the Confluent Cloud Console, go to the **Single sign-on** page at
   [https://confluent.cloud/sso](https://confluent.cloud/sso), or select **Single sign-on** in the
   navigation menu.
2. Turn off the **SCIM** toggle for your SSO identity provider.

Because SCIM depends on SSO, turning off SSO for your organization also stops
SCIM provisioning and revokes all active SCIM tokens.

<a id="scim-limitations"></a>

## Limitations

* SCIM requires the [Advanced Security add-on](../../../../advanced-security.md#advanced-security-add-on), SSO, and at least one verified trusted domain.
* When SCIM is enabled, you cannot invite new SSO users from Confluent Cloud.
  Local user accounts are not affected.
* Enabling SCIM does not turn off [JIT user provisioning](jit-user-provisioning.md#jit-user-provisioning). If both are enabled, users can still be
  provisioned at first SSO sign-in.
* SCIM does not support group membership synchronization. SCIM syncs
  user provisioning and de-provisioning only.