SCIM Provisioning
Automatically sync users and groups from your identity provider.
SCIM (System for Cross-domain Identity Management) automatically provisions users and groups from your identity provider to Doow. When you add, update, or deactivate users in your IdP, those changes sync to Doow automatically.
What you need
- A Doow workspace on the Business, Professional, or Enterprise plan.
- An identity provider that supports SCIM 2.0 (Okta, Azure AD, OneLogin, Google Workspace, JumpCloud, or any SCIM-compatible IdP).
- Admin access to both Doow and your identity provider.
How it works
- Your IdP sends user and group changes to Doow via the SCIM API.
- Doow creates, updates, or deactivates members based on the changes.
- Group memberships sync to Doow departments.
- Provisioned users can sign in immediately via SAML SSO.
What Doow syncs
| Resource | Doow mapping | Operations |
|---|---|---|
| Users | Members | Create, update, deactivate |
| Groups | Departments | Create, update, delete |
| Group memberships | Department assignments | Add, remove |
User attributes
| SCIM attribute | Doow field |
|---|---|
userName | Email address |
name.givenName | First name |
name.familyName | Last name |
active | Account status |
externalId | IdP identifier (internal) |
Doow extension attributes
Doow supports an optional SCIM extension for role and resource assignment:
urn:ietf:params:scim:schemas:extension:doow:2.0:User| Attribute | Description |
|---|---|
role | Doow role (e.g., admin, member, viewer) |
resources | Array of resource assignments |
Configure Doow
Generate a SCIM token and endpoint URL in Doow:
- Go to Company Settings → SCIM Provisioning.
- Select Enable SCIM.
- Copy the SCIM Base URL (e.g.,
https://api.doow.co/scim/v2). - Select Generate Token to create a bearer token.
- Copy the token immediately — it is only shown once.
Configure your identity provider
Use the SCIM Base URL and bearer token to configure provisioning in your IdP.
Provider-specific guides
Select your identity provider for detailed setup instructions:
Troubleshooting
| Symptom | Likely cause | Next action |
|---|---|---|
| Connection test fails | Invalid SCIM URL or token | Verify the URL ends with /scim/v2 and the token is correct |
| Users not syncing | Provisioning not enabled in IdP | Enable provisioning and assign users to the app |
| Duplicate users created | Email mismatch between IdP and Doow | Ensure userName maps to the exact email in Doow |
| Deactivated users still active | Deactivation not enabled in IdP | Enable "Deactivate Users" in IdP provisioning settings |
| Groups not syncing | Group provisioning not enabled | Enable group sync in your IdP's provisioning settings |
| 401 Unauthorized errors | Token expired or revoked | Generate a new SCIM token in Doow |
| 403 Forbidden errors | Token does not match organization | Verify the token was generated for the correct workspace |
Testing the connection
Most IdPs provide a "Test Connection" button during setup. If the test fails:
- Verify the SCIM Base URL ends with
/scim/v2. - Verify the bearer token is correct and not expired.
- Check that SCIM provisioning is enabled in Doow.
- Generate a new token if the current one may have been revoked.
Provisioning users to SaaS apps
When users are provisioned to Doow via SCIM, Doow can automatically provision or deprovision those users across the SaaS applications your organization uses.
How outbound provisioning works
- Your IdP provisions a user to Doow via SCIM.
- Doow identifies which SaaS apps the user should have access to based on their department, role, or assignment rules.
- Doow provisions the user to those apps via their APIs.
- When the user is deactivated in your IdP, Doow deprovisions them from all connected apps.
Supported apps for provisioning
Doow can provision and deprovision users to apps that support user management APIs. Check each integration's documentation for provisioning capabilities.
| Action | What happens |
|---|---|
| User created | User is provisioned to assigned apps based on rules |
| User updated | User attributes sync to connected apps |
| User deactivated | User is removed or suspended from all connected apps |
| User reactivated | User access is restored to previously assigned apps |
Configure app provisioning
- Go to Company Settings → Integrations.
- Select a connected app.
- Enable Auto-provisioning if available.
- Configure assignment rules (by department, role, or manual assignment).
Deprovisioning behavior
When a user is deactivated via SCIM:
- Immediate apps: User is removed within minutes (Slack, Google Workspace, Microsoft 365).
- Delayed apps: User is queued for removal on the next sync cycle.
- License recovery: Freed licenses are tracked in Doow for reallocation.
Revoking access
To revoke SCIM access:
- Go to Company Settings → SCIM Provisioning.
- Select Revoke Token.
- Confirm the action.
The current token is invalidated immediately. Your IdP will receive 401 errors on subsequent requests. Generate a new token if you need to re-enable provisioning.
Disabling SCIM
To disable SCIM provisioning:
- Disable provisioning in your identity provider first.
- Go to Company Settings → SCIM Provisioning in Doow.
- Toggle Enable SCIM to off.
Existing provisioned users remain in Doow but will no longer receive updates from your IdP.
Supported SCIM operations
Doow implements SCIM 2.0 with the following capabilities:
| Capability | Supported |
|---|---|
| Create users | Yes |
| Update users | Yes |
| Deactivate users | Yes |
| Delete users | Deactivates (soft delete) |
| Create groups | Yes |
| Update groups | Yes |
| Delete groups | Yes |
| Patch operations | Yes |
| Filtering | Yes (up to 200 results) |
| Bulk operations | No |
| Password sync | No |
SCIM endpoints
| Endpoint | Description |
|---|---|
GET /scim/v2/ServiceProviderConfig | Capability discovery |
GET /scim/v2/ResourceTypes | Supported resource types |
GET /scim/v2/Schemas | Schema definitions |
GET /scim/v2/Users | List users |
POST /scim/v2/Users | Create user |
GET /scim/v2/Users/:id | Get user |
PUT /scim/v2/Users/:id | Replace user |
PATCH /scim/v2/Users/:id | Update user |
DELETE /scim/v2/Users/:id | Deactivate user |
GET /scim/v2/Groups | List groups |
POST /scim/v2/Groups | Create group |
GET /scim/v2/Groups/:id | Get group |
PATCH /scim/v2/Groups/:id | Update group |
DELETE /scim/v2/Groups/:id | Delete group |
To verify provisioning is wired correctly, query the Service Provider Config discovery endpoint:
curl -H "Authorization: Bearer YOUR_TOKEN" \
https://api.doow.co/scim/v2/ServiceProviderConfigA successful response returns the service provider configuration JSON.
Next steps
- Configure SAML SSO for single sign-on.
- Review provisioned users in Company Settings → Team.