Provision people with SCIM

On the Enterprise plan, an owner lets Microsoft Entra ID, Okta or any SCIM 2.0 client add people to the organization, keep their details current and remove their membership when they are deactivated. Pushed groups can decide each person’s role.

What deprovisioning does

Deactivating or deleting someone in your identity provider removes only this organization’s membership and signs them out everywhere. Their account, surveys and responses stay, and so do their memberships in other organizations. Provisioning never changes an owner’s role, but it can remove an owner who isn’t the last one, and the last owner can’t be deprovisioned.

Set up

1. 1Open Integrations, then SCIM provisioning, and choose Create token. Copy it once: it starts with scim_, is shown a single time and only its hash is kept. Note the SCIM base URL shown on the page.
2. 2In your identity provider, add a SCIM connection with that base URL and the token. In Entra ID: Provisioning, Automatic, with the tenant URL and the secret token. In Okta: the app’s Provisioning tab, SCIM, HTTP Header authentication with the token.
3. 3Test the connection in your provider, then assign people and groups to the app.
4. 4Back in wrkflow, check that people appear. Under groups, choose the role each pushed group maps to. People join with the default role, or with the highest role of their groups.

wrkflow needs an email address for each person: map the work email, or use a user name that is an email address.

What leaves wrkflow

Nothing about surveys or responses. wrkflow answers your identity provider with the people and groups it provisioned: user name, emails, name and whether they are active.

If something goes wrong

• 401 from the SCIM endpoint: the token was revoked or mistyped. Create a new token and update your provider.
• An organization must have at least one owner: make someone else an owner first, then deprovision the last owner.
• People aren’t created: wrkflow needs an email, so map the work email or use an email-shaped user name.
• Your identity provider hasn’t called for days: check its provisioning status. Integrations flags a token that hasn’t been used for more than 3 days.

Single sign-on is separate from provisioning: see Single sign-on and verified domains. See Integrations for the statuses and how to ask support.