SCIM Provisioning Issues

SCIM issues usually involve identity provider configuration, token state, email normalization, external IDs, or group-to-role mapping.

User missing

Check whether the identity provider sent a create event, whether the user email matches the workspace domain policy, and whether the user was deactivated after creation.

Duplicate or wrong user

Compare normalized email, external ID, identity provider user ID, and previous membership events. Do not merge or delete users without an approved process.

Deactivation mismatch

If a deactivated user still has access or an active user lost access, inspect the most recent SCIM update/deactivate event and any manual member change.

Token issue

SCIM token creation and revocation are sensitive. Never reveal token values after creation. Token rotation should be guided and audited.