Skip to content
Tessera Tessera Docs

SCIM provisioning

Availability Ultimate · Enterprise.

SCIM lets your identity provider push user lifecycle changes to Tessera — create, update, and crucially deactivate — in real time. Configure it under Settings → Authentication → Provisioning.

Why SCIM as well as OIDC

Section titled “Why SCIM as well as OIDC”

OIDC is pull-at-login: it only acts when a user signs in. If you remove someone in the IdP, OIDC can block their next login but can’t proactively revoke a live session. SCIM is push-based: the IdP tells Tessera the user is deactivated immediately, so Tessera blocks the account and drops their active sessions right away. Use OIDC for login and SCIM for lifecycle.

Setup

Section titled “Setup”
  1. Toggle SCIM enabled and generate a bearer token; paste it into your IdP’s SCIM app.
  2. Copy the Base URL shown (for example https://<your-controller>/scim/v2) into the IdP.
  3. The IdP now provisions users through the standard SCIM 2.0 endpoints.

Deprovisioning

Section titled “Deprovisioning”

When the IdP marks a user inactive, Tessera:

  • marks the account disabled (password and OIDC sign-in are refused), and
  • revokes all of that user’s active sessions immediately.

This is the offboarding guarantee security teams need: disabled in the IdP means access gone everywhere in the same moment.

Two exceptions apply:

  • SCIM cannot deactivate a local (non-provisioned) administrator — any admin account created in Tessera rather than pushed from the IdP is protected, and the request returns 403.
  • SCIM user creation is subject to your plan’s seat cap — once the seat limit is reached, further creates return 402.

Authentication

Section titled “Authentication”

All SCIM requests must carry the configured bearer token. Requests without it are rejected. Keep the token secret and rotate it if it may have leaked.

Cookies