Help Center

Search
Log in
Sign up

Help Center

Log in
Sign up
Table of Contents

SCIM User Lifecycle

SCIM controls workspace enrollment while preserving the global Diggle account.

Provision

  1. The provider assigns the user and sends POST /Users with a valid email-shaped userName.
  2. Diggle creates or correlates the account and establishes the managed workspace relationship. The authorized workspace integration can provision without an approved email domain or existing membership. Account correlation and Microsoft identity ownership are separate checks; a matching email alone does not establish ownership.
  3. The workspace role is applied. Effective qualifying membership grants Enterprise access; a pending invitation does not.

SCIM does not create private project grants. Provisioning and first sign-in are separate steps: users accept the current terms at first use when required. A new Entra SCIM account with a valid activation binding can sign in with the same verified Microsoft identity without an additional Diggle password or email code. See Microsoft Entra SSO.

Deactivate

Send PATCH or PUT with active=false. Diggle removes managed workspace membership, invitations and related project grants. The global Diggle account, login and SSO identities, personal content, unrelated workspaces and the inactive SCIM resource remain.

When a user loses their Enterprise workspace, their account becomes Free. A previously cancelled personal paid plan is not restored.

Reactivate

Send active=true for the same SCIM resource. Permitted workspace membership can be restored without an extra flag, but:

  • Pending invitation state is not implicitly accepted.
  • Workspace/company suspension or account access restrictions still apply.
  • Historical private project grants and invitations are not recreated.
  • An old personal paid plan is not restored.

Local revoke and unblock

  1. A Diggle workspace admin can remove access directly or call revokeWorkspaceUserAccess using a Workspace API key and the canonical Diggle user ID (not the SCIM resource ID). For a SCIM-managed relationship, a local administrative veto is retained.
  2. A later source activation or grant-changing update receives 403 while the veto remains.
  3. An authorized admin deliberately clears only the block using the separate upsertWorkspaceUser clearLocalBlock action.
  4. The designated SCIM source may then send active=true; normal access checks still apply.

Profile-only partial updates can change the source profile without restoring missing access. Omitting active never implicitly recreates a missing membership. Another provisioning source cannot take over an already managed relationship.

Credential disablement is separate

Rotating a token invalidates the replaced credential; revoking it or disabling SCIM stops provisioning with the affected credentials. These actions do not delete established accounts, memberships or permanent Microsoft identities. Disabling SCIM is not an offboarding method, and re-enabling it does not make invalidated tokens valid again.

An unused first-sign-in activation is different from a permanent SSO identity. Its validity depends on the provisioning source, tenant, identity mapping and credential. Rotation, revocation, expiry or mapping changes can prevent activation. A new token alone does not renew a pending activation; contact Diggle for the supported review or reissue process and preserve the intended source and tenant.

SSO login cannot restore removed membership.

Related articles