Set Up SCIM Provisioning

Provision and manage Pivot members and groups from Okta, Microsoft Entra ID, or another SCIM 2.0 identity provider.

Pivot’s SCIM 2.0 integration lets Enterprise organizations provision, update, suspend, restore, and remove members from an identity provider (IdP). It also synchronizes groups and group membership.

Before You Begin

You need:

• A Pivot Enterprise organization.
• An organization-owned domain that is verified in Pivot.
• Control verified domain accounts enabled. See Controlling Verified Domain Accounts.
• Organization admin access in Pivot.
• A SCIM-capable IdP, such as Okta or Microsoft Entra ID.

Create the Pivot Connection

Configure Member Matching

Pivot supports two member identifiers:

Configure your IdP to match existing Pivot members by userName. Map the IdP’s work email or user principal name to userName.

Okta

In the Pivot app’s Provisioning > To App settings:

1. Map the Okta username or primary work email to userName.
2. Use userName as the unique identifier for matching Pivot members.
3. Enable the lifecycle actions you need: create, update, and deactivate users.
4. Assign a test user and confirm that the returned Pivot id is retained by Okta.

Microsoft Entra ID

In Enterprise applications > Pivot > Provisioning > Mappings:

1. Map userPrincipalName or mail to the target attribute userName.
2. Set Match objects using this attribute to Yes for userName and give it the highest matching precedence.
3. Do not use externalId as the target matching attribute.
4. Start with Provision on demand for a test member before enabling the provisioning cycle.

Supported Member Attributes

Pivot accepts these core user attributes:

• userName — required; must be a verified organization-owned email address.
• name.givenName and name.familyName.
• emails, including the primary email.
• active — false suspends access and true restores access.

Changing userName changes the member’s organization-managed email in Pivot. Deleting a SCIM user deactivates the member and is safe to retry.

Supported Groups and Operations

Pivot supports SCIM users, groups, and group membership through the standard /Users and /Groups resources. Supported operations include create, read, replace, patch, delete, and paginated list requests.

For user discovery, Pivot supports an equality filter on verified email:

GET /scim/v2/Users?filter=userName eq "member@example.com"

For group discovery, Pivot supports an equality filter on displayName. Responses are limited to 100 resources per page.

Troubleshooting

• A member is not found: Confirm the IdP is matching on userName and that the email exactly matches the member’s Pivot primary email.
• A member cannot be provisioned: Verify the email belongs to a domain that your organization owns and has verified in Pivot.
• The connection test fails: Confirm the base URL has no path after /scim/v2, the API key is current, and the integration still has organization Admin access.
• An externalId filter returns invalidFilter: Pivot ignores externalId on writes but does not support it for lookup. Use userName for matching.
• Requests return 401 Unauthorized: Rotate the integration API key in Pivot and update the bearer token in your IdP.