Connect your identity provider to Cloudairy with SCIM 2.0, so people are created, updated and removed automatically as they join, move or leave. SCIM works alongside SAML single sign-on: SSO signs people in, SCIM keeps the member list in sync.

Plan: SCIM provisioning is part of Cloudairy Enterprise. You need admin access to Cloudairy and to your identity provider, and an SSO connection already set up for your domain (see the Single Sign-On guide; its SCIM section shows where the token is created).

How it works

Each SSO connection has its own SCIM endpoint and bearer tokens. Your identity provider calls the endpoint to:

Create users when they are assigned to the Cloudairy app.
Update users: name and email changes.
Deactivate users when they are unassigned or leave. Their access to your workspace is removed; their Cloudairy account itself is not deleted, because a person can belong to other workspaces.
Push groups. Group names are stored with the user and applied through your group-to-role mapping the next time they sign in.

Step 1: Get your SCIM base URL and token

In Cloudairy, go to Settings → Security → Single sign-on.
Open your identity provider connection and find Automatic provisioning (SCIM 2.0).
Copy the SCIM base URL.
Click Generate token and copy the bearer token straight away. It starts with cscim_ and is shown only once.

You can create more than one token (for example, to rotate), and revoke any token from the same screen. Each token shows when it was created and last used.

Step 2a: Connect Okta

In Okta, open the Cloudairy SAML app and go to General → App Settings; enable SCIM provisioning.
On the Provisioning tab, set SCIM connector base URL to your SCIM base URL and Unique identifier field for users to userName.
Choose Push New Users, Push Profile Updates and Push Groups; set Authentication Mode to HTTP Header and paste the token as the Bearer token.
Click Test Connector Configuration, save, then under To App enable Create Users, Update User Attributes and Deactivate Users.

Step 2b: Connect Microsoft Entra ID

In the Entra admin center, open the Cloudairy enterprise application and go to Provisioning; set the mode to Automatic.
Under Admin Credentials, paste your SCIM base URL as the Tenant URL and the token as the Secret Token, then Test Connection.
Keep the default attribute mappings (userPrincipalName or mail to userName), save, and set Provisioning Status to On.

Other SCIM 2.0 providers (for example OneLogin) use the same two values: the base URL and the bearer token.

Supported attributes and operations

Attribute	How Cloudairy uses it
`userName`	Required. The user's email address; used to match existing members.
`emails`	Primary email; used if `userName` is not an email.
`name.givenName`, `name.familyName`	First and last name.
`externalId`	The identity provider's ID for the user.
`active`	`false` deprovisions the user from your workspace.
`groups`	Group names, applied through group-to-role mapping at next sign-in.

Area	Supported
Users	List with filter, create, get, replace (PUT), update (PATCH), delete (deprovision)
Groups	List, create, get, add and remove members, delete
Filters	`eq` on `userName`, `emails.value`, `externalId`, `displayName`; up to 200 results
Discovery	`ServiceProviderConfig`, `ResourceTypes` and `Schemas`
Not supported	Bulk operations

Troubleshooting

Issue	What to do
401 Invalid token	The token was revoked, mistyped, or its connection is disabled. Generate a new token and update your identity provider.
409 uniqueness	The person is already an active member. Your identity provider should match on `userName` instead of creating a new user.
400 Unsupported filter	Use an `eq` filter on a supported attribute.
Role did not change	Group changes apply at the user's next sign-in, through your group-to-role mapping.

Need help? Contact the Cloudairy team or see the Enterprise documentation.

Troubleshooting

Common SSO Issues

SAML authentication fails

If users cannot authenticate via SSO:

Verify Entity ID and ACS URL are correct in your IdP
Check that the x509 certificate is valid and properly formatted
Ensure the SAML Sign-in URL is accessible
Verify user attributes are being passed correctly

Users not being provisioned

If JIT provisioning is not working:

Ensure JIT provisioning is enabled
Check that user attributes are being sent from IdP
Verify the default team is selected
Check organization discovery domain settings

Certificate errors

If you encounter certificate issues:

Ensure the x509 certificate is in the correct format
Check that the certificate is not expired
Verify the certificate matches your IdP configuration
Try downloading a fresh certificate from your IdP

SCIM Provisioning Guide

How it works

Step 1: Get your SCIM base URL and token

Step 2a: Connect Okta

Step 2b: Connect Microsoft Entra ID

Supported attributes and operations

Troubleshooting

Troubleshooting

SAML authentication fails

Users not being provisioned

Certificate errors

Need Help?

Design, collaborate, innovate with Cloudairy

Design, collaborate, innovate with Cloudairy