> For the complete documentation index, see [llms.txt](https://docs.soda.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.soda.io/organization-and-admin-settings/user-provisioning-with-scim.md).

# User provisioning with SCIM

**Soda Cloud supports user provisioning through SCIM** (the System for Cross-domain Identity Management). With SCIM enabled, **your identity provider manages Soda Cloud users for you**: when someone joins your organization, Entra ID creates their Soda Cloud account, and when they leave, their access is revoked in the same sync. Your IT team administers Soda Cloud access from the identity provider they already use, with no manual user management in Soda Cloud.

{% hint style="info" %}
**SCIM provisioning is an opt-in feature** available to organizations with a Soda Enterprise plan. To enable it, contact Soda Support at <support@soda.io>.
{% endhint %}

### Prerequisites

* A Soda Cloud organization (Enterprise license) with SCIM provisioning enabled.
* The **Manage organization settings** permission. See [Global and dataset roles](/organization-and-admin-settings/global-and-dataset-roles.md).
* Administrator access to your tenant in Microsoft Entra ID.

## Generate a SCIM token in Soda Cloud

Entra ID authenticates against Soda Cloud with a bearer token that you generate in your organization settings.

{% stepper %}
{% step %}

#### Open the SCIM tab

In Soda Cloud, navigate to **your avatar**→ **Organization Settings**, then open the **SCIM** tab.

<figure><img src="/files/3NBXqZSePJ86uRqDRptF" alt="" width="563"><figcaption><p>Navigate to the SCIM tab on your org settings to see all available actions and configurations.</p></figcaption></figure>
{% endstep %}

{% step %}

#### Generate the token

Click **Generate token**. Soda Cloud generates a new token and displays it once.

<figure><img src="/files/bXYXXHLQnE8z3u0wcPHI" alt="" width="563"><figcaption><p>After clicking on "Generate token", Soda will display a randomly generated token.</p></figcaption></figure>
{% endstep %}

{% step %}

#### Copy and store the token

Copy the token and store it securely, then click **Done**.

{% hint style="warning" %}
After you click **Done**, Soda Cloud never displays the token again. If you lose the value, you can [regenerate the token](#regenerate-token) (see below).
{% endhint %}
{% endstep %}
{% endstepper %}

#### Regenerate token

Soda Cloud never displays a generated token after leaving the bearer token screen. If you lose the value, click **Regenerate token**; this deletes the previous token and replaces it with a new one, so any existing SCIM connection that uses the old token stops working until you update it.

<figure><img src="/files/tRlZwXLXlOODSKUe7f9O" alt="" width="563"><figcaption><p>Click on "Regenerate token" to delete previous token and replace it with a new one.</p></figcaption></figure>

## Configure SCIM in Entra ID

{% hint style="info" %}
This step must be performed by an Azure Entra ID administrator in your organization.
{% endhint %}

{% stepper %}
{% step %}

#### Open provisioning for the application

In the Microsoft Entra admin center, navigate to **Enterprise applications**, then select the application that represents your Soda Cloud organization.

<figure><img src="/files/VKkYhW6T5slVKFkFwHdG" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Start the connection flow

Select **Provisioning**, then start the flow by selecting **Connect your application**.

<figure><img src="/files/X6vvnHqXWf1PBMhCQgEm" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Configure the provisioning connection

Configure the provisioning connection as follows:

| **Authentication method** | Bearer authentication                                                                                                                    |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Tenant URL**            | <ul><li>Soda EU: <code><https://cloud.soda.io/scim/v2></code></li><li>Soda US: <code><https://cloud.us.soda.io/scim/v2></code></li></ul> |
| **Secret token**          | Paste the SCIM token you generated in Soda Cloud.                                                                                        |

<figure><img src="/files/kzw1RDq0Rgd2AFid6Dev" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Test the connection

Click **Test connection** and verify that the connection test succeeds.

<figure><img src="/files/I6npskt3W7FTemtoVZZj" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## Verify that provisioning works

{% hint style="info" %}
This step must be performed by an Azure Entra ID administrator in your organization, and a Soda Cloud user with **Manage organization settings** permission.
{% endhint %}

### Verification using provision on demand

The quickest way to confirm the integration is Entra ID's **provision on demand**, which syncs a single user **immediately** instead of waiting for a scheduled provisioning cycle.

{% stepper %}
{% step %}

#### Provision a test user

Provision a test user on demand on Entra ID.

<figure><img src="/files/5CAgZz2q0kij1Bju6d2p" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Confirm user

Confirm in Soda Cloud that the user appears in **Organization Settings** under the **Users** tab.

<figure><img src="/files/l2PEA6n5MaMO4OOyTvyb" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

### Verification using the full provisioning

Once regular provisioning runs, you can observe synced users and their actions, such as "Create" or "Disable", in the **Entra ID provisioning logs**.

{% hint style="info" %}
**Entra ID runs provisioning on its own schedule**, so changes to users and user groups in your identity provider can take some time to appear in Soda Cloud; refer to [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user#how-long-will-it-take-to-provision-users) for details on the provisioning cycle.
{% endhint %}

<figure><img src="/files/HD3jIBwwmGd73I1vNY93" alt=""><figcaption><p>The Entra ID provisioning logs will expose the actions taken for each user</p></figcaption></figure>

In Soda Cloud, the **Users** and **User Groups** tabs in **Organization Settings** display a **Managed by SCIM** column that identifies which users and user groups are provisioned through your identity provider.

<figure><img src="/files/wzVFPr3iD4mEYuAgk13U" alt=""><figcaption><p>The column <strong>managed by SCIM</strong> appears when SCIM provisioning is enabled and working.</p></figcaption></figure>

> For single sign-on setup, refer to [User and user group management with SSO](/organization-and-admin-settings/user-and-user-group-management-with-sso.md).

> For details on the roles and permissions of provisioned users, refer to [Global and dataset roles](/organization-and-admin-settings/global-and-dataset-roles.md).

***

## Limitations

Soda has tested and documented SCIM provisioning with **Microsoft Entra ID**. It is currently the **only supported identity provider** for SCIM.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.soda.io/organization-and-admin-settings/user-provisioning-with-scim.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.