> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tuple.app/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning

> Automatically provision and deprovision Tuple user accounts from your identity provider

SCIM (System for Cross-domain Identity Management) automatically provisions and deprovisions user accounts in Tuple when you update them in your identity provider. This eliminates manual user management and ensures access stays in sync.

## Getting credentials

SCIM credentials are issued per-team. To enable SCIM:

1. Send an email to [support@tuple.app](mailto:support@tuple.app) requesting SCIM provisioning.
2. Once approved, your credentials appear on the [Team Management page](https://production.tuple.app/team_management/invitations).

<img src="https://mintcdn.com/tuple-0f82e5be/mvUxndXY5Na4FaZB/images/team-management/sso/okta/scim-credentials-backend.png?fit=max&auto=format&n=mvUxndXY5Na4FaZB&q=85&s=29d6a528ccc0b9e06a3b2bcd6c2f3c64" alt="SCIM credentials on the Team Management page" width="2184" height="532" data-path="images/team-management/sso/okta/scim-credentials-backend.png" />

Your credentials are a SCIM username and a SCIM password. Providers that authenticate with basic auth, like Okta, use them directly. Providers that ask for a single bearer token or secret token, like Microsoft Entra ID and OneLogin, use both values joined with a colon: `<SCIM username>:<SCIM password>`.

## Provider-specific guides

<CardGroup cols={3}>
  <Card title="Okta" icon="key" href="/team-management/scim-okta">
    Okta SCIM connector
  </Card>

  <Card title="Microsoft Entra ID" icon="microsoft" href="/team-management/scim-entra-id">
    Formerly Azure AD
  </Card>

  <Card title="OneLogin" icon="lock" href="/team-management/scim-onelogin">
    SCIM Provisioner with SAML
  </Card>
</CardGroup>

## How SCIM works with Tuple

| Action in your identity provider | Result in Tuple                           |
| -------------------------------- | ----------------------------------------- |
| Assign user to Tuple app         | Account created, seat billing begins      |
| Remove user from Tuple app       | Account deprovisioned, seat billing stops |
| Update user profile              | Name and email updated in Tuple           |

## Tuple's SCIM endpoints

| Field                   | Value                                                |
| ----------------------- | ---------------------------------------------------- |
| SCIM connector base URL | `https://production.tuple.app/scim/v2`               |
| Unique identifier field | `userName`, stored as the user's Tuple email address |

Map `userName` to the same email address your SAML configuration sends. When the two disagree -- for example, SCIM sending a UPN while SAML sends `mail` -- each flow matches a different account and users end up duplicated.

## Questions?

[Email us](mailto:support@tuple.app) if you need help setting up SCIM provisioning.