Help Center

Search
Log in
Sign up

Help Center

Log in
Sign up
Table of Contents

Set Up SCIM Provisioning

Provision and manage workspace users using SCIM 2.0. SCIM manages workspace enrollment, roles and the provisioning source’s user profile; SSO authenticates the global Diggle account. Enable SCIM separately from Workspace API and SSO.

Create a provisioning token

  1. Ask Diggle to enable SCIM provisioning for the workspace. The disabled SCIM Provisioning card offers Contact Diggle.
  2. As a workspace admin, open Manage Workspace → Integrations.
  3. On SCIM Provisioning, select Create provisioning token.
  4. Select the Identity provider. Enter its Source tenant / instance ID; for Microsoft Entra, enter the Entra tenant ID. Keep this source identity stable when replacing a token.
  5. Select Create token. Copy the secret before closing the copy-once dialog.
  6. Copy the SCIM endpoint using Copy endpoint. Continue with the provider connection below.

Treat the provisioning token as a server-side secret. It is shown once and cannot be retrieved later. Do not commit it, log it or expose it in browser code. A provisioning token is not a Workspace API key.

Connect the identity provider

  1. Use the HTTPS SCIM endpoint copied from Integrations as the base URL. Do not append /Users if the provider expects a base URL.
  2. Supply the provisioning token in the provider’s token field. Requests must carry Authorization: Bearer <scim-token>.
  3. Enable User provisioning and disable Group and Bulk synchronization. Configure deprovisioning as active=false, not DELETE.

Attribute mappings

Source valueSCIM targetRequirement
Approved work email or email-shaped principaluserNameRequired on create and PUT.
The same approved email valueemails[type eq “work”].valueOptional duplicate representation; must match userName after trimming and case normalization.
Display namedisplayNameOptional; do not map name components.
Stable provider object identifierexternalIdRecommended correlation value; not an SSO identity.
Lifecycle stateactiveBoolean. New resources must be active; false deprovisions an existing User.
Approved workspace roleurn:ietf:params:scim:schemas:extension:diggle:2.0:User:roleOptional admin, creator or runner.

Remove unsupported default mappings, including company/HR fields, name.formatted, name.givenName, name.familyName, email labels and projectIds. Only one work email is supported.

Test and provision

  1. Test Connection. A valid no-match Users query returns HTTP 200 with an empty Resources array. Authentication success alone does not prove provisioning mappings are correct.
  2. Start with a deliberately limited set of test users. Initial enrollment requires an approved workspace email domain or an established workspace membership.
  3. Create a user and retain its returned SCIM id for later updates. Verify the intended workspace role and account-link/sign-in flow separately.
  4. Test profile updates, active=false and active=true. Verify unrelated workspaces remain intact and historical private projects are not restored.
  5. Test assignment removal and provider deletion behavior before expanding scope.

Token lifecycle

ActionEffect
CreateA new token is shown once. Creating it does not itself enable SCIM.
Rotate provisioning tokenA replacement is shown once. The old token becomes invalid immediately. Source identity, resource IDs, scope and any expiry are retained. Update the provider promptly.
Revoke provisioning tokenThe token becomes invalid. SCIM remains enabled so a replacement can be created. Existing users and access remain unchanged.
Expired tokenCannot authenticate. An expired token cannot be rotated; create a replacement with the same source identity.

Disable SCIM provisioning

Diggle can disable SCIM for the workspace. This invalidates its provisioning credentials and prevents further authenticated provisioning. Re-enabling requires a fresh token; revoked tokens do not revive.

Disabling SCIM does not deactivate or delete existing users, remove memberships, change roles, change SSO or change Enterprise licensing by itself. To remove access, use explicit SCIM active=false or a Diggle workspace revoke.

Supported operations

Method and pathResult
POST /UsersCreate an active User; 201 and a Location header. Duplicate create returns 409.
GET /Users/{id}Read the source-owned User; 200 or 404.
GET /UsersList and filter Users with pagination.
PUT /Users/{id}Replace supported profile fields; preserve omitted activity and role.
PATCH /Users/{id}Update supported fields with add, replace or supported remove operations.
PUT or PATCH active=falseRemove managed workspace access while retaining the User resource.
PUT or PATCH active=trueRequest workspace reactivation, subject to Diggle access rules.

Paths are relative to the SCIM endpoint copied from Integrations. Responses use application/scim+json. The role extension accepts admin, creator and runner.

Discovery

Authenticated GET/HEAD requests are supported for /ServiceProviderConfig, /ResourceTypes, /ResourceTypes/User, /Schemas and /Schemas/{schemaURI}. User is the only supported resource type.

Unsupported capabilities

  • SCIM Groups and Bulk.
  • Terminal SCIM DELETE. Authenticated DELETE returns 405 without deprovisioning; use active: false. For administrator-led offboarding, use revokeWorkspaceUserAccess with a separate Workspace API key. This removes workspace access and sets a local block that SCIM cannot override; it does not delete the global account.
  • Project provisioning, projectIds and reprovision extensions.
  • Sorting, attribute projection, ETags, conditional writes and password changes.
  • Arbitrary name components, company or HR attributes, and multiple email addresses.

Related articles