AIM is configured per SSO provider from Admin Settings → Access → Single Sign-on. Open the
provider’s ⋯ menu, choose Manage user provisioning, and find the Automatic identity
management row in the Provisioning step.
AIM vs. SCIM
| SCIM | AIM | |
|---|---|---|
| Direction | Your identity provider pushes changes to Generate | Generate pulls from your identity provider on a schedule |
| Credential | One-time bearer token you paste into your IdP | Okta: API Services private key. Entra ID: no shared secret — a federated credential |
| Latency | Near real-time | Every 5 minutes to 24 hours (you set the interval) |
| Nested groups | Not supported by Okta/Entra’s SCIM push | Supported — group membership is resolved transitively |
You can run AIM and SCIM on the same provider, but Generate treats this as advisory-conflicting
— a user tagged as SCIM-managed stays under SCIM’s control even while AIM is enabled, to avoid the
two systems fighting over the same account. Pick one per provider where you can.
Enable AIM for Okta
Create an Okta API Services app
In the Okta Admin Console, go to Applications → Create App Integration → API Services. In the
new app’s General Settings → Client Credentials, uncheck “Require Demonstrating Proof of
Possession (DPoP) header in token requests.”
Open Configure AIM in Generate
On the Automatic identity management row, click Configure. In Step 1 — Configure
identity provider, enter your Okta org URL, Client ID, optional Key ID, and the
Private key (PEM) from the app you just created.
Test the connection
Click Test connection. On success, Generate shows “Connection tested successfully” and you
can review a dry-run preview of how many users would be provisioned, updated, deactivated, or
denied.
Enable AIM for Microsoft Entra ID
Entra ID’s version of AIM uses Workload Identity Federation instead of a shared secret — Entra verifies tokens signed by Generate using a public key it fetches from Generate’s own JWKS endpoint.Open Configure AIM in Generate
On the Automatic identity management row, click Configure. Generate pre-fills Tenant ID
and Client ID from the Microsoft Entra ID SSO provider you already set up, and shows a
read-only Issuer and Subject for the next step.
Add a federated credential in Entra
In the same App Registration used for SSO, go to Certificates & secrets → Federated credentials
→ Add credential, choose scenario Other issuer, and paste in the Issuer and Subject
values shown in Generate’s modal. Leave Audience at its default.
Grant Graph API permissions
On the same App Registration, go to API permissions and add all four Application permissions:
User.Read.All, Group.Read.All, GroupMember.Read.All, and Application.Read.All. Click
Grant admin consent and confirm each shows as granted.Scope and schedule
Both providers share the same scope and cadence controls:- Sync group IDs — a comma-separated list of group IDs to restrict which users AIM syncs. Leave empty to sync everyone in the directory.
- Poll interval (seconds) — how often Generate checks for changes. Ranges from 300 seconds (5 minutes) to 86,400 seconds (24 hours); the default is 900 seconds (15 minutes).
Managing AIM after setup
Once enabled, the management screen shows:- Status — Active or Inactive, with Last polled, Next poll, Last success, and Last error timestamps.
- Recent syncs — a table of each run’s result (Success, Partial, or Failed) and how many users were provisioned, updated, deactivated, or denied.
- Account Access Denylist — add specific users, groups, or service principals that should be excluded from sync even if they match your scope, with a reason for the record. Removing a deny entry lets the next sync tick re-evaluate that subject.