Skip to navigation
AdminAuthentication

Manage users and teams with SCIM

View as Markdown

Configuring System for Cross-domain Identity Management (SCIM) for your Sigma organization allows you to centralize management of users and teams through your identity provider (IdP). The following document provides an overview of SCIM and steps to configure SCIM with Sigma.

The configuration instructions in this document can be applied to all supported IdPs. If you use Okta as your IdP, see Manage users and teams with SCIM and Okta.

System and user requirements

  • You must be assigned the Admin account type.
  • Your Sigma organization must use SAML. Your organization cannot use a password-based authentication method, such as SAML or password.
  • Guest users cannot be enabled in your organization.
  • SCIM provisioning is not supported for free trials organizations.

Limitations

  • Importing groups to an IdP from Sigma teams is not currently supported.

Overview of SCIM

SCIM is a standard that automates user and group provisioning between a service provider, like Sigma, and an identity provider (IdP). Configuring SCIM for your organization allows you to create and manage users and groups in your IdP, and then automatically push them to your Sigma organization as users and teams. After SCIM provisioning is enabled, all future management of users and teams must be done through your IdP.

SCIM with SAML

SAML allows single sign-on (SSO) and management of users, but when using SAML alone, syncing new users and updates between your IdP and Sigma is not automatic. A user must log in to Sigma for updates to persist in Sigma. When you add SCIM to your SAML configuration, you can manage Sigma teams from your IdP, and both user and team data in your IdP are automatically synced to your Sigma organization.

Considerations when transitioning to SCIM

If you transition to SCIM after you have already created users and teams in Sigma, you will no longer be able to manage them in Sigma. They will still be displayed in the Administration portal, but you will have to manage them through your IdP:

  • Users: Your IdP might allow you to link to an existing user with the same email address in Sigma. No work is lost, and the user can then be managed through your IdP. Alternatively, you might be able to import users from Sigma into your IdP.

  • User account types: After transitioning to SCIM, Sigma automatically respects user account types defined in the IdP, regardless of what user account types were originally set in Sigma.

  • Guest users: SCIM doesn’t disable existing guest user accounts. However, your organization must turn off guest access before you can enable account type and team provisioning, and then re-enable it after SCIM provisioning is complete.

  • Teams: Your IdP might allow you to link a group in your IdP to an existing team in Sigma. No work is lost, and admin management of that team can then be maintained through your IdP.

Manage SCIM bearer tokens with a service account

All new SCIM bearer tokens that are generated are tied to an automatically created service account, instead of the account of the Sigma admin that generated it. When bearer tokens are associated with a service account, SCIM provisioning does not break if the user that originally configured SCIM is deactivated or their license type changed. The service account is automatically created when you Enable provisioning in Sigma. No additional configuration is required to set up this service account.

For organizations with SCIM provisioning enabled before October 14 2026, your organization does not use a service account to manage SCIM bearer tokens. No changes are made to your existing SCIM configuration, and the bearer token for those organizations continues to be tied to the admin user that generated it. If you want to use a service account to manage your SCIM bearer token, you must remove provisioning in Sigma, and re-enable it by following the steps in Configure SCIM for your organization.

Service account considerations

  • This service account cannot be modified, archived, or deleted by an admin.
  • The service account is owned by Sigma and does not count towards your organization’s license count.
  • The service account cannot take actions like creating a document or modifying team settings. It does not appear in any user lists, search results, or audit logs.
  • If a user is deactivated, documents associated with that user are never transferred to the service account. The documents transfer to the Sigma admin with the longest admin tenure, excluding the user being deactivated. If no other active admin user exists, you are blocked from deactivating the user.
  • To revoke a service account owned SCIM bearer token, you must remove provisioning in Sigma, and re-enable it by following the steps in Configure SCIM for your organization.

Configure SCIM for your organization

To configure SCIM for your Sigma organization, perform the following steps:

  1. Enable provisioning in Sigma
  2. Enable provisioning in your IdP
  3. Add users and teams

Enable provisioning in Sigma

  1. Go to Administration > Authentication.

  2. In Account type and team provisioning, select Set up.

  3. Review the guidance provided in the Provision roles and teams from IdP modal, then select the confirmation checkbox and select Next to continue.

  4. (Only for organizations that do not use a service account to manage SCIM bearer tokens) When prompted to create a token to authenticate your integration with your IdP, enter a token name, then click Next.

  5. On the Copy Keys section, copy the Bearer token and Directory base URL. Copy and store these values in a secure location. You need them to complete the integration with your IdP.

  6. Click Done.

Enable provisioning in your IdP

Next, you must configure provisioning in your IdP. Steps for this process differ depending on your IdP. You need the Bearer token and Directory base URL (for all IdPs except Okta) that you saved when setting up provisioning in Sigma.

Refer to the documentation from your IdP to configure provisioning. If you’re using Okta as your IdP, see Manage users and teams with SCIM and Okta.

Use the same SCIM Bearer token for all IdPs that you plan to provision users and teams from.

Add users and push groups/teams

Do not use SCIM provisioning for the same user across multiple IdPs. Users should be provisioned by a maximum of one IdP to avoid conflicts in information between IdPs.

After provisioning is enabled, you can start managing users and groups/teams from your IdP and pushing these updates to Sigma. For steps, refer to the documentation for your IdP. After SCIM is set up to provision users and teams, you can no longer manage users and teams in Sigma.

Troubleshooting and notes

Some common issues and questions when configuring SCIM and possible solutions:

If your organization uses a service account to manage SCIM bearer tokens, your provisioning continues to work normally. If you do not use a service account, you must re-enable provisioning in Sigma.

If your organization uses a service account to manage SCIM bearer tokens, your provisioning should continue to work normally. If you do not use a service account, you must re-enable provisioning in Sigma.

Changing a user’s username when you have SCIM configured is not recommended. Changing a user’s username creates a new account for that user in Sigma and does not update the username of an existing user.

User accounts created before SCIM was configured cannot be managed in the IdP or in the Sigma UI. Instead, update the user by making a PATCH request to the PATCH /v2/members/{memberId} endpoint and set the isArchived field to true for the user.

If you have a user that was assigned to a Sigma team prior to enabling SCIM, and that user remains in that team even though they aren’t in the application group in your IdP, you can remove the user from the team by using the Sigma API to update the team membership. Alternatively, you can turn off SCIM in Sigma, make the changes to your teams, then turn it back on.

For additional assistance, contact Sigma Support.