SCIM provisioning
Also called: directory sync, automated user provisioning, SCIM 2.0
What is SCIM provisioning?
SCIM provisioning is a standard that lets an identity provider create, update, and deactivate accounts inside an application automatically. When somebody joins, changes team, or leaves in the directory, the application is updated without anybody performing the change by hand.
What the provider actually drives.
Three lifecycle events, and the third is the one that matters most.
Joining
A new hire appears in the directory and the account exists in the application without a request being filed. Access is a property of employment rather than of somebody having remembered to ask.
Changing
Team moves and attribute changes flow through, so group membership stays true. This is what keeps role assignment from drifting away from reality over a year.
Leaving
Deactivation in the directory deactivates the account. This is the reason SCIM exists: manual offboarding is the step organizations most reliably get wrong.
Why manual provisioning fails.
Not because people are careless, but because the work is invisible until it is a problem.
Dormant accounts accumulate
Every application somebody forgot to revoke is an account nobody is watching that still works.
Onboarding delay is real cost
Waiting on a manual grant is dead time on somebody first week, repeated per application.
Auditors test offboarding
Being able to show that leaving the directory ends access is a much stronger answer than a documented process.
Commonly confused with.
Three things nearby.
SCIM provisioning questions
What is SCIM provisioning?
A standard that lets an identity provider create, update, and deactivate accounts in an application automatically, so directory changes drive access without anyone applying them by hand.
How is it different from SSO?
SSO authenticates somebody who already has an account. SCIM creates and deactivates the account itself. Adjacent halves of the same problem, usually deployed together.
Why does it matter more than onboarding speed?
Offboarding. Manual revocation is the step organizations most reliably miss, and every missed one is a working account nobody is watching.
Does provisioning grant product access?
No. It creates the account. A seat for a specific product is a separate decision an org admin makes, since seats are what unlock each product.
Does Virex support SCIM?
Yes, as part of the platform governance set alongside SSO and SAML, RBAC, audit logging, and retention policy.
Let the directory drive access.
SCIM, SSO, RBAC, and audit logging come with the platform.