SCIM provisioning connects your identity provider to Generate so accounts are created, updated, and deactivated automatically — and teams stay in sync — without manual invitations. Changes made in your identity provider are pushed to Generate in real time.
SCIM is set up per SSO provider and is available for OIDC and SAML providers. You configure it from Admin Settings → Access → Single Sign-on.

​
Enable SCIM

1

Open user provisioning

On the Single Sign-on page, open the ⋯ menu for your provider and choose Manage user provisioning. In the Provisioning step, find the SCIM row (“External API identity provider sync”) and click Set up user provisioning.
2

Turn on SCIM

Click Enable SCIM. Generate reveals a SCIM endpoint URL and a one-time bearer token.
The bearer token is shown only once — Generate stores only a hash. Copy it now and keep it somewhere safe.
3

Configure your identity provider

Paste the SCIM endpoint URL into your identity provider’s SCIM connector configuration, and the bearer token into its token/secret field. In Okta this is the Provisioning tab of your app; in Entra it’s the enterprise application’s Provisioning settings.
4

Verify

Assign a user (or push a change) from your identity provider and confirm it appears under Recent SCIM operations.

​
Managing SCIM after setup

Once SCIM is enabled, the management screen shows:
  • Last push received and last token rotated timestamps.
  • Rotate token — issues a new bearer token. The old token stops working immediately, so update your identity provider right away.
  • Disable SCIM — stops accepting pushes from your identity provider.
  • Recent SCIM operations — a table of When / Operation / Target / Result code, so you can confirm creates, updates, and deactivations are landing.
Pair SCIM with group-to-team mapping so provisioned users land in the right Generate teams automatically. If you’d rather Generate pull changes from your identity provider on a schedule instead of waiting for pushes, see AIM provisioning.

AIM provisioning

The pull-based alternative to SCIM.

Group-to-team mapping

Route provisioned users into the right teams.

Audit log

Review provisioning and account events.