Skip to main content
SCIM provisioning creates, updates, and deactivates TestDino users from your identity provider (IdP). When someone joins a group in Okta or Microsoft Entra ID, they get a TestDino account at your default role. When they leave, their access is removed and their seat is freed. SCIM builds on SSO. Set up Single Sign-On first, including domain verification and enforcement.

​
Quick Reference

​
Before you start

  • SSO is enabled and enforced on a verified domain. SCIM-provisioned users sign in only through SSO, so enforcement is required.
  • An Owner or Admin account in TestDino.
  • SCIM enabled on your plan. Enabling SCIM returns a plan error otherwise, so contact support@testdino.com to upgrade.
  • IdP admin access to configure provisioning.

​
How provisioning works

Your IdP is the source of truth for your roster. TestDino gives you a SCIM base URL and a secret token, you paste both into your IdP’s provisioning settings, and the IdP pushes changes from then on. Provisioned users are always created at the organization’s default SSO role, never as owner, and only for email addresses on a verified domain.

​
Enable SCIM and generate a token

1

Open the SCIM section

Go to Settings → Single Sign-On and find the SCIM section.
2

Enable SCIM

Click Enable SCIM. The section stays disabled until SSO is enabled and enforced on a verified domain.
3

Generate the token

Click Generate token and copy the td_scim_ token immediately. It is shown once and cannot be retrieved later, so store it in your secret manager before leaving the page.
Your SCIM base URL is the same for every organization:
Generating a new token invalidates the previous one the moment you generate it. Update your IdP with the new token in the same sitting, or provisioning stops until you do.

​
Connect your identity provider

1

Add the SCIM connector

Go to Applications → Browse App Catalog, search for SCIM 2.0 Test App (OAuth Bearer Token), and click Add integration. This is Okta’s general-purpose SCIM connector. Name it something recognizable, such as TestDino Provisioning.
2

Configure the API integration

Open the app’s Provisioning tab, click Configure API Integration, and check Enable API integration.Click Test API Credentials, then Save.
3

Enable the provisioning actions

Under Provisioning → To App → Edit, enable Create Users, Update User Attributes, and Deactivate Users, then save.
4

Assign users and groups

Open the Assignments tab and assign the people or groups who need TestDino access. Assigning a user creates them in TestDino, and unassigning deactivates them.
TestDino matches users by email, so the app must map the user’s email to the SCIM userName attribute. Okta’s default mapping already does this.

​
What create and deactivate do

The organization owner cannot be deprovisioned through SCIM. This is deliberate, and it protects your organization from an accidental lockout when the owner is unassigned in the IdP.

​
Guests and external users

SCIM provisions only people whose email is on a domain you have verified. Guests on an outside address, such as a partner’s domain or a personal account, cannot be provisioned through SCIM, for the same reason they cannot be provisioned through SSO. To give an external person access, either verify the domain their email uses, or invite them into your organization by email so they use a standard login. Learn more about inviting members in Users, Roles & Permissions.

​
Troubleshooting

If provisioning fails for a specific user and the cause is not clear, contact support@testdino.com with the user’s email address and the approximate time of the attempt.

Single Sign-On (SSO)

Connect your OIDC identity provider and verify your domain.

Users, Roles & Permissions

Understand the roles a provisioned user can receive.

Organization Settings

Manage your organization profile and ownership.

Security & Compliance

Review how TestDino handles credentials and customer data.