Help Center

Search
Log in
Sign up

Help Center

Log in
Sign up
Table of Contents

Set Up SCIM Provisioning

Provision and manage workspace users using SCIM 2.0. SCIM manages workspace enrollment, roles and the provisioning source’s user profile; SSO authenticates the global Diggle account. Enable SCIM separately from Workspace API and SSO. Workspace API does not need to be enabled for SCIM provisioning.

Create a provisioning token

  1. Ask Diggle to enable SCIM provisioning for the workspace. The disabled SCIM Provisioning card offers Contact Diggle.
  2. As a workspace admin, open Manage Workspace → Integrations.
  3. On SCIM Provisioning, select Create provisioning token.
  4. Select the Identity provider. Enter its Source tenant / instance ID; for Microsoft Entra, enter the Entra tenant ID as a GUID, not an onmicrosoft.com domain. Keep this source identity stable when replacing a token.
  5. Select Create token. Copy the secret before closing the copy-once dialog.
  6. Copy the SCIM endpoint using Copy endpoint. Continue with the provider connection below.

Treat the provisioning token as a server-side secret. It is shown once and cannot be retrieved later. Do not commit it, log it or expose it in browser code. A provisioning token is not a Workspace API key.

Connect the identity provider

  1. Use the HTTPS SCIM endpoint copied from Integrations as the base URL. The production base endpoint is https://api.diggle.com/scim/v2. In Microsoft Entra, use this base endpoint as Tenant URL without appending /Users.
  2. Supply the provisioning token in the provider’s token field. Requests must carry Authorization: Bearer <scim-token>. In Entra’s Secret Token field, paste only the token, without the Bearer prefix.
  3. Enable User provisioning and disable Group and Bulk synchronization. Configure deprovisioning as active=false, not DELETE.

Attribute mappings

Source value

SCIM target

Requirement

Work email or email-shaped principal

userName

Required on create and PUT.

The same email value

emails[type eq “work”].value

Optional duplicate representation; must match userName after trimming and case normalization.

Display name

displayName

Optional; do not map name components.

Stable provider object identifier

externalId

Recommended correlation value; not an SSO identity.

Lifecycle state

active

Boolean. New resources must be active; false deprovisions an existing User.

Approved workspace role

urn:ietf:params:scim:schemas:extension:diggle:2.0:User:role

Optional admin, creator or runner.

Remove unsupported default mappings, including company/HR fields, name.formatted, name.givenName, name.familyName, email labels and projectIds. Only one work email is supported.

Test and provision

  1. Test Connection. A valid no-match Users query returns HTTP 200 with an empty Resources array. Authentication success alone does not prove provisioning mappings are correct.
  2. Start with a deliberately limited set of test users. An authorized workspace integration can provision without an approved email domain or existing membership. This does not make email matching proof of global account or Microsoft identity ownership.
  3. Create a user and retain its returned SCIM id for later updates. Verify the intended workspace role and account-link/sign-in flow separately.
  4. Test profile updates, active=false and active=true. Verify unrelated workspaces remain intact and historical private projects are not restored.
  5. Test assignment removal and provider deletion behavior before expanding scope.

Token lifecycle

Action

Effect

Create

A new token is shown once. Creating it does not itself enable SCIM.

Rotate provisioning token

A replacement is shown once. The old token becomes invalid immediately. Source identity, resource IDs, scope and any expiry are retained. Update the provider promptly.

Revoke provisioning token

The token becomes invalid. SCIM remains enabled so a replacement can be created. Existing users and access remain unchanged.

Expired token

Cannot authenticate. An expired token cannot be rotated; create a replacement with the same source identity.

Token rotation, revocation or expiry can invalidate an unused first-sign-in activation for a new SCIM account. A replacement token alone does not renew that activation. Preserve the provisioning source and tenant and contact Diggle for the supported review or reissue process. Established Microsoft SSO identities are not deleted by token changes.

Disable SCIM provisioning

Diggle can disable SCIM for the workspace. This invalidates its provisioning credentials and prevents further authenticated provisioning. Re-enabling requires a fresh token; revoked tokens do not revive.

Disabling SCIM does not deactivate or delete existing users, remove memberships, change roles, delete permanent SSO identities or change Enterprise licensing by itself. To remove access, use explicit SCIM active=false or a Diggle workspace revoke.

Supported operations

Method and path

Result

POST /Users

Create an active User; 201 and a Location header. Duplicate create returns 409.

GET /Users/{id}

Read the source-owned User; 200 or 404.

GET /Users

List and filter Users with pagination.

PUT /Users/{id}

Replace supported profile fields; preserve omitted activity and role.

PATCH /Users/{id}

Update supported fields with add, replace or supported remove operations.

PUT or PATCH active=false

Remove managed workspace access while retaining the User resource.

PUT or PATCH active=true

Request workspace reactivation, subject to Diggle access rules.

Paths are relative to the SCIM endpoint copied from Integrations. Responses use application/scim+json. The role extension accepts admin, creator and runner.

Discovery

Authenticated GET/HEAD requests are supported for /ServiceProviderConfig, /ResourceTypes, /ResourceTypes/User, /Schemas and /Schemas/{schemaURI}. User is the only supported resource type.

Unsupported capabilities

  • SCIM Groups and Bulk.
  • Terminal SCIM DELETE. Authenticated DELETE returns 405 without deprovisioning; use active: false. For administrator-led offboarding, use revokeWorkspaceUserAccess with a separate Workspace API key. This removes workspace access and sets a local block that SCIM cannot override; it does not delete the global account.
  • Project provisioning, projectIds and reprovision extensions.
  • Sorting, attribute projection, ETags, conditional writes and password changes.
  • Arbitrary name components, company or HR attributes, and multiple email addresses.

Related articles