SCIM
Governing SCIM 2.0-enabled applications with SailPoint’s standards-based connector.
The SCIM connector governs applications that expose a SCIM 2.0 API, using the standard schema for accounts and groups, with each operation configured as an HTTP call rather than hard-coded to one application.
- SCIM connector type: the standards-based SCIM 2.0 connector
- Onboarding: aggregate then correlate
- You configure aggregate, create, update, delete, enable and disable as SCIM API calls with mapped responses.
- Common issues covered in troubleshooting
The SCIM connector governs applications that speak SCIM 2.0, using the standard schema for accounts and groups rather than an integration written per application. Instead of writing Java, you configure each operation, aggregate, create, update, delete, enable, disable, as an HTTP call with mapped responses.
Connector type and how it connects
The SCIM integration is the standards-based SCIM 2.0 connector. It is configured per operation with HTTP requests, authentication (token/OAuth/basic) and response mappings, rather than being hard-coded to one application. As with every connector, the flow is the same: authenticate to SCIM, read accounts and entitlements during aggregation, and write changes during provisioning.
Onboarding the source
- 1. Configure the connection and credentials for SCIM.
- 2. Map the account schema, defining the aggregation request and mapping the JSON/XML response fields to account and entitlement attributes.
- 3. Set the correlation logic so SCIM accounts attach to the right identities (typically on a stable key such as employee ID or email).
- 4. Run account aggregation and confirm accounts and entitlements load.
- 5. Verify correlation, watching for uncorrelated/orphan accounts.
Provisioning capabilities
SailPoint performs provisioning by invoking the configured create/update/delete/enable/disable operations as HTTP requests, with response handling to confirm success. This makes almost any modern SaaS or in-house SCIM-enabled app governable without custom code.
Entitlements and what to govern
What counts as an entitlement depends on the application; map whatever the API exposes as assignable access (roles, groups, permissions) into entitlement attributes.
Troubleshooting
When SCIM aggregation or provisioning fails, work through the usual causes in order:
- Test each configured operation against the API independently (for example with Postman).
- Verify authentication (token/OAuth) and its refresh behaviour.
- Check the response mapping matches the actual payload structure.
- Confirm rate limits are respected to avoid throttling.
Common pitfalls
- Credential expiry (tokens/secrets/certs) silently breaking the connector.
- Insufficient rights on the SCIM service account for the operations you need.
- Schema or correlation misconfiguration leaving accounts uncorrelated.