What is SCIM?
SCIM, the System for Cross-domain Identity Management, is an open standard for keeping user and group records in step between an identity system and the applications that depend on it. The current version, SCIM 2.0, is defined by the IETF in RFC 7643, the schema for users, groups and their attributes, and RFC 7644, the protocol, with its concepts and requirements set out in RFC 7642. In practice the identity provider, such as Microsoft Entra ID or Okta, acts as the SCIM client, and each SaaS application exposes a SCIM endpoint. When HR hires, moves or terminates someone and the directory changes, the identity provider pushes the change to every connected app on its own.
How SCIM works
SCIM is a REST API that exchanges JSON over HTTPS. Users and groups are resources at standard paths such as /Users and /Groups, and ordinary HTTP methods act on them: POST creates, GET reads or searches, PUT replaces, PATCH changes selected attributes and DELETE removes. Discovery endpoints such as /ServiceProviderConfig and /Schemas tell the client what the application supports. The client usually authenticates with an OAuth bearer token that the application issues for the integration.
Example: deactivating a leaver
When a termination reaches the identity provider, it sends each connected app a request like this:
PATCH /scim/v2/Users/7d1e4b2a-91c3-4f0e-a8b6-3c5d2e9f1a40
Content-Type: application/scim+json
{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"replace","path":"active","value":false}]}
Setting active to false disables the account in the application without deleting its data, and well-built apps also end the user's existing sessions. Because the change is pushed, it takes effect even if the person never signs in again, which is the whole point.
Security considerations
- Protect the token. A SCIM bearer token can create accounts, change group memberships and sometimes grant admin roles. Keep it in a secrets manager, scope it narrowly, rotate it and log its use.
- Check attribute and group mappings. One mapping error can put every user in an administrators group, or stop deactivations from being sent at all.
- Watch for sync failures. A provisioning job that silently stops leaves departed users active in the app.
- Cover the gaps. Applications without SCIM support still need manual or scripted deprovisioning and belong on access review lists.
SCIM vs. SAML vs. just-in-time provisioning
SAML and OpenID Connect handle sign-in: they tell an application who the user is at login. SCIM handles the account life cycle: it creates, updates and removes accounts whether or not anyone signs in. Just-in-time (JIT) provisioning creates an account from the assertion on a user's first single sign-on, which is convenient but has no way to remove the account later; disabling the user at the identity provider blocks new SSO logins, but local passwords, API tokens or open sessions in the app may keep working. Many organizations pair SSO for authentication with SCIM for provisioning.
SCIM on the CompTIA Security+ exam
SCIM is not on the SY0-801 acronym list, so expect it as the mechanism behind a scenario rather than as a named answer. The idea is tested under objective 4.5, which covers provisioning and deprovisioning accounts, and automated user provisioning is also taught as a security automation use case under objective 4.6. Wording such as "automatically create and disable accounts in SaaS applications when HR records change" or "a standard API for provisioning users across cloud apps" points to SCIM if it is offered, or to automated provisioning. Distractors include SAML and OAuth, which handle sign-in and delegated authorization rather than account creation, and LDAP, a directory access protocol rather than a cross-domain provisioning standard.