> ## Documentation Index
> Fetch the complete documentation index at: https://docs.testdino.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Provisioning for TestDino

> Create, update, and deactivate TestDino users automatically from Okta or Microsoft Entra ID using SCIM 2.0 provisioning.

export const HowToSchema = ({name, description, steps = []}) => {
  const schema = {
    "@context": "https://schema.org",
    "@type": "HowTo",
    name,
    ...description ? {
      description
    } : {},
    step: steps.map(({name: stepName, text}, i) => ({
      "@type": "HowToStep",
      position: i + 1,
      name: stepName,
      text
    }))
  };
  return <script type="application/ld+json" dangerouslySetInnerHTML={{
    __html: JSON.stringify(schema)
  }} />;
};

<HowToSchema
  name="Set up SCIM provisioning for TestDino"
  description="Enable SCIM in TestDino, generate a provisioning token, and connect Okta or Microsoft Entra ID so users are created and deactivated automatically."
  steps={[
{ name: "Confirm SSO is enforced", text: "SCIM requires SSO enabled and enforced on a verified domain, because provisioned users sign in only through SSO." },
{ name: "Enable SCIM in TestDino", text: "Go to Settings then Single Sign-On, open the SCIM section, and click Enable SCIM." },
{ name: "Generate a provisioning token", text: "Click Generate token and copy the td_scim_ token immediately. It is shown only once." },
{ name: "Connect your identity provider", text: "Paste the SCIM base URL https://user.testdino.com/scim/v2 and the token into the provisioning settings in Okta or Microsoft Entra ID." },
{ name: "Assign users and groups", text: "Assign the people or groups who should have TestDino access. Assigning creates a user, unassigning deactivates them." },
]}
/>

SCIM provisioning creates, updates, and deactivates TestDino users from your identity provider (IdP). When someone joins a group in Okta or Microsoft Entra ID, they get a TestDino account at your default role. When they leave, their access is removed and their seat is freed.

SCIM builds on SSO. Set up [Single Sign-On](/platform/organizations/single-sign-on) first, including domain verification and enforcement.

## Quick Reference

| Step | What you do                                    | Where    |
| :--- | :--------------------------------------------- | :------- |
| 1    | Enable SCIM and generate a token               | TestDino |
| 2    | Paste the base URL and token into provisioning | Your IdP |
| 3    | Enable create, update, and deactivate          | Your IdP |
| 4    | Assign users and groups                        | Your IdP |

| Setting        | Value                                 |
| :------------- | :------------------------------------ |
| SCIM base URL  | `https://user.testdino.com/scim/v2`   |
| Authentication | OAuth bearer token, prefix `td_scim_` |
| SCIM version   | 2.0                                   |
| User matching  | By email address                      |

## Before you start

* **SSO is enabled and enforced** on a verified domain. SCIM-provisioned users sign in only through SSO, so enforcement is required.
* An **Owner or Admin** account in TestDino.
* **SCIM enabled on your plan.** Enabling SCIM returns a plan error otherwise, so contact [support@testdino.com](mailto:support@testdino.com) to upgrade.
* **IdP admin access** to configure provisioning.

## How provisioning works

Your IdP is the source of truth for your roster. TestDino gives you a SCIM base URL and a secret token, you paste both into your IdP's provisioning settings, and the IdP pushes changes from then on.

| IdP action                        | TestDino result                                                      |
| :-------------------------------- | :------------------------------------------------------------------- |
| Assign a user to the app          | User is created at your default SSO role and can sign in through SSO |
| Update the user's name or details | Changes sync to the TestDino account                                 |
| Unassign or deactivate the user   | Access to your organization is removed and the seat is freed         |

Provisioned users are always created at the organization's **default SSO role**, never as `owner`, and only for email addresses on a **verified domain**.

## Enable SCIM and generate a token

<Steps>
  <Step title="Open the SCIM section">
    Go to **Settings → Single Sign-On** and find the **SCIM** section.
  </Step>

  <Step title="Enable SCIM">
    Click **Enable SCIM**. The section stays disabled until SSO is enabled and enforced on a verified domain.
  </Step>

  <Step title="Generate the token">
    Click **Generate token** and copy the `td_scim_` token immediately. It is shown once and cannot be retrieved later, so store it in your secret manager before leaving the page.
  </Step>
</Steps>

Your SCIM base URL is the same for every organization:

```text theme={null}
https://user.testdino.com/scim/v2
```

<Warning>
  Generating a new token invalidates the previous one the moment you generate it. Update your IdP with the new token in the same sitting, or provisioning stops until you do.
</Warning>

## Connect your identity provider

<Tabs>
  <Tab title="Okta" icon="https://mintcdn.com/testdino/f30a9B57lPhwKHtl/images/okta.svg?fit=max&auto=format&n=f30a9B57lPhwKHtl&q=85&s=309099065a04e57c6e624d210d5dc972" width="63" height="63" data-path="images/okta.svg">
    <Steps>
      <Step title="Add the SCIM connector">
        Go to **Applications → Browse App Catalog**, search for **SCIM 2.0 Test App (OAuth Bearer Token)**, and click **Add integration**. This is Okta's general-purpose SCIM connector. Name it something recognizable, such as `TestDino Provisioning`.
      </Step>

      <Step title="Configure the API integration">
        Open the app's **Provisioning** tab, click **Configure API Integration**, and check **Enable API integration**.

        | Field              | Value                               |
        | :----------------- | :---------------------------------- |
        | SCIM 2.0 Base URL  | `https://user.testdino.com/scim/v2` |
        | OAuth Bearer Token | your `td_scim_` token               |

        Click **Test API Credentials**, then **Save**.
      </Step>

      <Step title="Enable the provisioning actions">
        Under **Provisioning → To App → Edit**, enable **Create Users**, **Update User Attributes**, and **Deactivate Users**, then save.
      </Step>

      <Step title="Assign users and groups">
        Open the **Assignments** tab and assign the people or groups who need TestDino access. Assigning a user creates them in TestDino, and unassigning deactivates them.
      </Step>
    </Steps>

    <Callout icon="circle-info" color="#3B82F6">
      TestDino matches users by email, so the app must map the user's email to the SCIM `userName` attribute. Okta's default mapping already does this.
    </Callout>
  </Tab>

  <Tab title="Azure Entra ID" icon="https://mintcdn.com/testdino/f30a9B57lPhwKHtl/images/microsoft-entra-id.svg?fit=max&auto=format&n=f30a9B57lPhwKHtl&q=85&s=c62233d2318d1fdb26d641b93b646bd7" width="18" height="18" data-path="images/microsoft-entra-id.svg">
    <Steps>
      <Step title="Open provisioning on the app">
        Go to **Entra admin center → Enterprise applications**, open the application you use for SSO, and select **Provisioning → Get started**. Set **Provisioning Mode** to **Automatic**.
      </Step>

      <Step title="Enter the admin credentials">
        Under **Admin Credentials**:

        | Field        | Value                               |
        | :----------- | :---------------------------------- |
        | Tenant URL   | `https://user.testdino.com/scim/v2` |
        | Secret Token | your `td_scim_` token               |

        Click **Test Connection**, then **Save**.
      </Step>

      <Step title="Check the attribute mappings">
        Under **Mappings**, keep **Provision Microsoft Entra ID Users** on and confirm the user's email is mapped. TestDino matches users by email, so provisioning fails for any user without one.
      </Step>

      <Step title="Scope and assign">
        Under **Settings**, set **Scope** to **Sync only assigned users and groups** and save. Then assign the people and groups under the app's **Users and groups**.
      </Step>

      <Step title="Turn provisioning on">
        Set **Provisioning status** to **On**. Entra syncs on a schedule of roughly 40 minutes. To test a single user immediately, use **Provision on demand**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## What create and deactivate do

| Event                            | Effect in TestDino                                                                                                                                                                               |
| :------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Create** (user assigned)       | A new user is created at your default role and can sign in through SSO. If the person already has a TestDino account, they are added to your organization and their existing login is unchanged. |
| **Update**                       | Name and profile details sync from the IdP.                                                                                                                                                      |
| **Deactivate** (user unassigned) | The user is removed from your organization and the seat is freed. If your organization was their only one, the account is fully disabled.                                                        |

<Warning>
  The organization owner cannot be deprovisioned through SCIM. This is deliberate, and it protects your organization from an accidental lockout when the owner is unassigned in the IdP.
</Warning>

## Guests and external users

SCIM provisions only people whose email is on a domain you have verified. Guests on an outside address, such as a partner's domain or a personal account, cannot be provisioned through SCIM, for the same reason they cannot be provisioned through SSO.

To give an external person access, either verify the domain their email uses, or invite them into your organization by email so they use a standard login. Learn more about inviting members in [Users, Roles & Permissions](/platform/organizations/users-roles).

## Troubleshooting

| Symptom                                       | Cause                                                            | Fix                                                                                                             |
| :-------------------------------------------- | :--------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------- |
| Test connection fails                         | Wrong URL, or a truncated token                                  | Confirm the URL is exactly `https://user.testdino.com/scim/v2` and paste the full `td_scim_` token              |
| "Invalid token" or an authentication error    | Token was rotated, or SSO was disabled or un-enforced            | Re-copy the current token, then confirm SSO is still enabled and enforced                                       |
| The IdP connects but nobody is created        | Provisioning actions are off, or nobody is assigned              | Enable **Create Users** in Okta or set **Provisioning status** to **On** in Entra, then assign users to the app |
| A specific user is never created              | Their email is not on a verified domain, or you are out of seats | Verify the domain, or free a seat or upgrade the plan                                                           |
| A user is created without a name              | Email is mapped but the name attributes are not                  | Check the attribute mappings in your IdP                                                                        |
| The owner stays active after being unassigned | Expected. Owners are protected from SCIM deprovisioning.         | Transfer ownership first, then deprovision the account                                                          |

If provisioning fails for a specific user and the cause is not clear, contact [support@testdino.com](mailto:support@testdino.com) with the user's email address and the approximate time of the attempt.

## Related

<CardGroup cols={2}>
  <Card title="Single Sign-On (SSO)" icon="shield-halved" href="/platform/organizations/single-sign-on">
    Connect your OIDC identity provider and verify your domain.
  </Card>

  <Card title="Users, Roles & Permissions" icon="users" href="/platform/organizations/users-roles">
    Understand the roles a provisioned user can receive.
  </Card>

  <Card title="Organization Settings" icon="gear" href="/platform/organizations/settings">
    Manage your organization profile and ownership.
  </Card>

  <Card title="Security & Compliance" icon="shield-check" href="/data-privacy/security-compliance">
    Review how TestDino handles credentials and customer data.
  </Card>
</CardGroup>