SCIM provisioning
Let your identity provider add, update and remove members and roles in My Journey Analytics automatically with SCIM 2.0.
SCIM lets your identity provider, such as Okta or Microsoft Entra ID, manage who is in your organization. When you assign someone to the app in your identity provider, they become a member; when you unassign them, they lose access. Groups in your identity provider become roles.
SCIM is available on plans that include SCIM provisioning. It is set up per verified domain, so your plan also needs Verified domains, and the domain must be verified first; see Authentication domains and single sign-on. Only organization admins and owners can set it up.
Turn on SCIM
- Open Settings → Organization → Authentication.
- Next to the verified domain, open the menu (⋯) and choose Configure SCIM.
- Turn on Enable SCIM.
- Copy the SCIM Base URL and the Bearer Token into your identity provider's SCIM settings.
The base URL looks like https://app.myjourneyanalytics.com/scim/v2/ followed by an ID unique to this setup. Your identity provider sends the token in an Authorization: Bearer header with every request.
The SCIM badge in the domain's Integrations column turns green once SCIM is on.
What your identity provider can do
| Resource | What it does in My Journey Analytics |
|---|---|
| Users | Creates, updates and deactivates members of your organization |
| Groups | Creates, renames and deletes roles, and sets who is in each one |
Users
Every user needs an email address on one of your organization's verified domains; other addresses are refused. Your identity provider can send the person's first and last name too.
- A new person gets an account and joins your organization as a member.
- A person who already has an account is added to your organization.
- Deactivating or deleting a user removes them from your organization. Their account itself is kept, along with any other organizations they belong to.
People created through SCIM have no password. Set up SAML on the same domain so they can sign in.
Groups
Each group becomes a role with the group's name. If a role with that exact name already exists, the group uses it. Adding or removing people from the group in your identity provider changes who has the role. Deleting the group deletes the role.
Supported features
| Feature | Supported |
|---|---|
| Users and Groups | Yes |
Updating with PATCH | Yes |
| Filtering lists | Yes |
| Bulk requests | No |
| Sorting | No |
| Changing passwords | No |
Your identity provider can read the full list from ServiceProviderConfig, ResourceTypes and Schemas under the base URL.
Check what your identity provider sent
To see recent SCIM requests for a domain, open the menu (⋯) next to it and choose View SCIM logs. Each request shows its time, method, path, status, identity provider and duration, and you can open one to see its headers and bodies.
Turn off SCIM
Open Configure SCIM and turn off Enable SCIM, then confirm. Your identity provider can no longer manage members. Existing members stay, and SAML sign-in keeps working.
Related
Can't find what you need? Contact support