# SCIM provisioning

Probo supports SCIM 2.0 for automating user lifecycle changes. SCIM provisioning manages user records and organization access; [SAML SSO](/docs/product/sso/overview) handles authentication. New people usually receive the **Employee** membership role — set a different role in [People](/docs/product/roles-and-permissions). For attribute-driven roles at sign-in without SCIM managing the profile, use the SAML [Role Attribute](/docs/product/sso/overview#membership-roles-from-saml).

## Synchronization modes

Probo offers two ways to keep organization people in sync with your directory. Both end at the same SCIM Users resource; they differ in **who initiates** the change.

| Aspect | **Native** | **SCIM Bridge** |
| ------ | ---------- | --------------- |
| When to use | Provider has solid SCIM push support | Provider does not support SCIM, or supports it poorly |
| Direction | Push — the identity provider calls Probo | Pull — Probo reads the directory |
| Timing | Near real time on assignment changes | Periodic reconciliation on a schedule |
| Typical providers | [Okta](/docs/product/scim/okta) | [Google Workspace](/docs/product/scim/google-workspace), [Microsoft 365 / Entra ID](/docs/product/scim/microsoft-365) |
| Who is synced | Whoever you assign to the Probo app in the IdP | Directory users, minus Bridge exclusions (for example service accounts or shared mailboxes) |

### Native

The provider pushes changes directly to Probo. This is the standard IdP → app pattern when the provider can push SCIM reliably: when someone is assigned to the Probo application (or removed), the provider sends SCIM create, update, or deactivate requests to Probo’s endpoint. [Okta](/docs/product/scim/okta) is the primary Native path.

For Microsoft Entra ID, prefer [SCIM Bridge](/docs/product/scim/microsoft-365) over Native push — both paths are documented on that page.

### SCIM Bridge

The Bridge covers providers that do not support SCIM or support it poorly — including **Microsoft Entra ID**, where Bridge is recommended (Native remains available). Instead of waiting for the IdP to push, Probo connects to a supported directory, reads users on a schedule, and reconciles them with organization people through the same SCIM path. Use exclusions to keep identities you do not want in Probo out of the sync.

Choose one authoritative mode for a population. Running overlapping push and pull automation without a clear owner can cause repeated or conflicting changes.

## Endpoint and credentials

SCIM requests use the `/api/connect/v1/scim/2.0` endpoint and a bearer token created for a SCIM configuration. The Users resource supports standard create, read, list, replace, patch, and delete operations implemented by the deployment.

The token is a provisioning credential, not a personal API key. Store it in the identity provider’s secret storage, do not log it, and regenerate it when access changes or disclosure is suspected.

## Events and failure handling

SCIM events preserve request outcomes for operational review and export. Monitor failed events and bridge status rather than assuming directory changes were applied. Before removing a large assignment group, confirm how the provider represents deactivation and deletion and test with a limited population.

Provider-specific setup pages for [Google Workspace](/docs/product/scim/google-workspace), [Microsoft 365](/docs/product/scim/microsoft-365), and [Okta](/docs/product/scim/okta) remain available separately.