usertasksDocs
Sign in

Governance and security

SCIM provisioning

Let Microsoft Entra ID, Okta, OneLogin, JumpCloud or any SCIM 2.0 client push users and groups to UserTasks.

Set up

  1. Settings → SSO & Directory → SCIM provisioning → Create token. Copy the token — it is shown once.
  2. In your identity provider, add a SCIM 2.0 app with:
    • Tenant URL / SCIM base URL: https://<your UserTasks>/scim/v2 (shown on the page);
    • Secret token / API token: the token, sent as Authorization: Bearer <token>.
  3. Assign users and groups and start provisioning.
Identity providerWhere
Microsoft Entra IDEnterprise application → Provisioning → Automatic; Test connection, then map attributes (userName ← userPrincipalName, emails[type eq "work"].value ← mail). Entra's provisioning quirks — capitalised op names, "False" strings, filters like members[value eq "…"] — are handled.
OktaApp → Provisioning → SCIM 2.0, authentication HTTP Header (the token); enable Push New Users, Push Profile Updates, Push Groups and Deactivate Users.
OneLogin, JumpCloud, Keycloak (SCIM plugin), othersthe same base URL and bearer token.

Behaviour

  • Users follow the directory rules: linked by email or created, active: false and DELETE remove access in this workspace at once (the account is kept). Passwords sent by the IdP are ignored.
  • Groups become teams, members kept in step (people added by hand stay).
  • Every request acts on the token's workspace only; another workspace's ids are not found, and members from other workspaces are ignored.
  • Supported: /Users, /Groups (GET, POST, PUT, PATCH, DELETE), /.search on both, filters (eq ne co sw ew gt ge lt le pr, and / or / not, value filters like emails[type eq "work"]), startIndex / count paging (up to 1000), attributes / excludedAttributes, weak ETags with If-Match / If-None-Match, and the discovery endpoints /ServiceProviderConfig, /ResourceTypes, /Schemas (core User with the enterprise extension, Group). Not supported: bulk, sorting, password changes.

Tokens

Tokens are stored as SHA-256 hashes, can be limited to scopes (users:read, users:write, groups:read, groups:write) and given an expiry. Rotate issues a new token with the same name and scopes; the page keeps the old one working for an hour so you can update the IdP (grace_minutes through the API, 0 = revoke now). Requests are limited to 1200 per minute per token (rate_limit_per_minute in the SCIM settings), and repeated failed authentication from one address is throttled. Disable revokes every token at once.