Configure SCIM User Provisioning with HRIS/IdP for Appspace Cloud

Configure SCIM user provisioning in Appspace Cloud to automate user lifecycle and profile updates from your IdP or HRIS. This article is for IT administrators who manage identity integration for Appspace Cloud. After you complete these steps, you can enable SCIM in Appspace, connect a SCIM-compliant client, and keep users and profile attributes in sync.

For: IT Administrator — Account Owners configuring SCIM provisioning for Appspace Cloud

What’s in this article:

Prerequisites

• Account Owner role with an Appspace Platform user license.

• A HRIS or IdP that is SCIM 2.0 compliant. Appspace has tested and officially supports Microsoft Entra ID (Azure AD) and Okta. Most SCIM-compliant IdPs and many HCM systems can integrate with Appspace; confirm support with your provider.

• The username must use the user's email address.

• Identify and configure the user attributes to map in Appspace. See Configure SAML Attributes for Appspace Cloud.

SCIM and SSO

SCIM and SSO are configured separately and serve different purposes:

• SCIM — user provisioning, updates, and de-provisioning.

• SSO — user authentication.

SSO is not required to use SCIM. Users can authenticate with Appspace credentials by default, or with SSO if you enable it. Appspace recommends using SCIM with SAML-based SSO when you want both automated provisioning and identity-provider authentication.

For SSO, Appspace supports a primary and a secondary identity provider. If you need additional SSO providers, contact Appspace Support. For SSO configuration steps, see Configure Single Sign-On (SSO) & Just-in-Time (JIT) for Appspace Cloud.

SCIM Endpoint Behavior

Appspace provides a single SCIM Base URL and bearer token for the account. Any SCIM-compliant client configured with those credentials can send provisioning and profile updates to Appspace.

If more than one system writes to this endpoint:

1. Different users from different systems — No conflict. Each user is provisioned and updated by its source system.

2. Same user, same mapped fields — For overlapping attributes, the most recent update received by Appspace is kept (last write wins).

3. Same user, different fields — Works when each system maps different attributes. If both map the same field, last write wins for that field.

Configure Your Identity Provider

Use your preferred SCIM-compliant IdP or HRIS as the source of record for user attributes. When both an IdP and an HRIS are in place, the IdP often acts as the SCIM client that transfers data to Appspace. SCIM-compliant HRIS tools can also connect to Appspace when your provider supports that setup.

Use the following vendor resources when configuring your preferred IdP:

• Microsoft Entra ID (Azure AD) — Managing user account provisioning for enterprise apps in the Azure portal. For an Appspace-focused walkthrough, see SCIM - Azure Setup.

• Okta — Build a SCIM provisioning integration overview. For an Appspace-focused walkthrough, see Configuring Okta SCIM with Appspace.

Enable Single Sign-On Authentication

Complete this section only if you want users to authenticate with SSO. SSO is optional for SCIM.

SSO Prerequisites

• IdP metadata, or the SSO URL and the x.509 certificate.

• An Identity Provider that is SAML 2.0 compliant.

• Account Owner role with an Appspace Platform user license.

• Configure the IdP to pass the correct attributes to Appspace, such as First Name, Last Name, and Username.

Enable SSO

1. Log in to the Appspace console.

2. Click the ☰ Appspace menu, and select Users. Click Settings at the bottom of the left menu.

   

3. Click the Account Authentication side panel tab.

4. In the AUTHENTICATION METHOD section, select Single Sign-On (SSO) from the drop-down menu.

   

5. In the SINGLE SIGN-ON (SSO) SETTINGS section, select the desired Login Method:

   • SSO only — Users must sign in with their single sign-on credentials. Only admins can sign in with an Appspace password.

   • SSO or Appspace Credentials — Admins and users can sign in with either Appspace or single sign-on credentials.

6. In the IDENTITY PROVIDER (IDP) INFORMATION section, configure the IdP settings using one of the following methods:

   

   • Drop or upload the IdP metadata XML file.

   • Manually enter the SSO URL and X.509 Certificate details.

7. In the GENERATING SERVICE PROVIDER (SP) METADATA section, select the desired Data binding (IdP to SP) option:

   • Redirect — Users are redirected to the Identity Provider. SSO details are passed in a query string with ?SAMLRequest= as part of the URL.

   • Post — SSO details are passed using the POST method. Ensure the Identity Provider has direct access to the Appspace server for this method to work.

8. Click Save.

Enable SCIM User Provisioning

When you configure your IdP or HRIS to integrate with Appspace, enable SCIM in Appspace and provide the SCIM Base URL and bearer token to your SCIM client. Also configure the unique ID for users, supported provisioning actions, and authentication mode in your SCIM client.

Enable SCIM

1. Log in to the Appspace console.

2. Click the ☰ Appspace menu, and select Users. Click Settings at the bottom of the left menu.

   

3. Click the Settings tab, and click the User Provisioning side panel tab.

4. Select the SCIM radio button from the User Provisioning options, and click Save.

5. Copy the SCIM Base URL and ensure the SCIM Bearer Token has been generated:

   

   • SCIM Base URL — The API endpoint that connects the provisioning system with Appspace. Example: https://cloud.appspace.com/identity/scim.

   • SCIM Bearer Token — The authentication token for the SCIM API. Automatically generated; click Generate New Token to create a new token.

6. Optionally, select the Enable User Group Sync checkbox to include user groups in SCIM provisioning.

7. Optionally, enable Allow Automatic Activation to let SSO-enabled accounts activate automatically without email invitations. This option is available only when SSO is enabled.

8. Configure the following settings in the Email Notifications section:

   • Invited Users — Users invited by the administrator are sent an email invitation. This option cannot be disabled. Click Edit template to modify the email content and appearance, including language, sender display name, subject, accent color, logo, banner, title, description, and additional text. Click Restore to default to undo changes, then Save or Cancel.

   • Added Users — If enabled, users provisioned by SCIM also receive an email invitation. Click Edit template to modify the email content and appearance, with options similar to Invited Users.

9. Click Save.

After you save SCIM settings in Appspace, configure your IdP or HRIS with the SCIM Base URL and bearer token, then start provisioning from that system.

Related Articles

• Introduction to Configuring SSO with Appspace

• Configure Single Sign-On (SSO) & Just-in-Time (JIT) for Appspace Cloud

• Configure SAML Attributes for Appspace Cloud

• Bring Organizational Clarity to Employees: A Guide to the Org Chart

• SCIM - Azure Setup