SCIM (System for Cross-domain Identity Management) is an open standard for automating the exchange of user identity information between systems: used to provision, update, and deprovision user accounts across applications automatically. It’s the protocol that keeps user accounts in sync, so that when someone joins, changes roles, or leaves, their access is created, updated, or revoked consistently everywhere.

Managing user accounts manually across many applications is slow and error-prone, and stale accounts (especially un-revoked ones for people who’ve left) are a security risk. SCIM automates this lifecycle.

How SCIM works

SCIM defines a standard schema for user (and group) identities and a REST/JSON API for managing them. An identity provider or directory acts as the source of truth and uses SCIM to push changes to connected applications: create a user, update their attributes, add them to groups, or deactivate them. Because the schema and API are standardized, one integration pattern works across any SCIM-compliant application, rather than building custom sync for each.

Why SCIM matters

SCIM directly supports the joiner-mover-leaver lifecycle central to identity governance. When an employee is hired, SCIM provisions their accounts automatically; when they change roles, it updates access; when they leave, it deprovisions them promptly, closing the orphaned-account gap that attackers exploit. This automation improves both security (no lingering access) and efficiency (no manual account management), and it’s a staple of workforce identity, though the concept of automated provisioning applies broadly.

SCIM in context

SCIM is typically paired with authentication/federation standards: SAML or OIDC handle single sign-on (authentication), while SCIM handles provisioning (account lifecycle), together they cover "can this person log in?" and "does this person have an account and the right access in the first place?" For organizations managing identities across many SaaS and internal apps, SCIM is what makes centralized, automated identity administration practical.

Frequently asked questions

What does SCIM stand for?

System for Cross-domain Identity Management.

What is SCIM used for?

Automating user provisioning, updates, and deprovisioning across applications, keeping accounts and access in sync.

How does SCIM relate to SAML/OIDC?

SAML/OIDC handle authentication (SSO); SCIM handles provisioning (account lifecycle), they’re complementary.

Why is SCIM important for security?

It ensures prompt deprovisioning, closing the orphaned-account gap that attackers exploit when access isn’t revoked.

Related: Identity Provider (IdP) · IAM · Single Sign-On (SSO) · SAML · User Management