What SCIM does to accounts and groups

This article explains how the service treats what the identity provider sends over SCIM, so you know what to expect when someone joins, changes or leaves.

People

Groups

• Each group is stored with the technical name scim- followed by an identifier and the directory's name as its description; the console lists it by the directory's name, with «Technical name: scim-…» underneath.
• Members are only people this directory provisioned. Members added by hand are never seen or removed by SCIM.
• Every membership change ends the member's sessions (permissions may have changed).
• Removing a group archives it.

Administrators

SCIM never creates or promotes administrators. An account an administrator promoted is protected: renaming or re-enabling it answers 400 (mutability) and disabling the last active administrator answers 409.

Local accounts and connectors

SCIM only touches accounts it created itself. Accounts created in the console and accounts of a directory connector never become SCIM's, and vice versa.

Limits

Pages of up to 200 resources, 1 MiB per request, 1,000 operations per PATCH and 600 requests per minute per token and network. The /Bulk endpoint is not supported. Conditional writes with If-Match answer 412 when the resource changed.

Licence seats

A creation beyond the licence's seats is refused with 403. Disabling people frees seats.