SCIM

SCIM

Where is this feature available?

Free / Open-source

Paid

Boost

Scale

Enterprise

SCIM enables you to automatically sync users and their roles from your identity provider (IdP) into PostHog. This is useful for automatically creating accounts and assigning roles when someone joins your organization, and disabling accounts when they leave.

How SCIM works

• Assigning a user to the SCIM app in your IdP creates them in PostHog with the mapped role.
• Removing a user from the app deactivates their PostHog account.
• Users with matching emails in PostHog are updated to match the IdP details and roles.
• Roles are matched by name (case-sensitive).
• SCIM configuration changes (enabling, disabling, token rotation) are recorded in the activity log.

Prerequisites

Before setting up SCIM, you need:

1. Verified authentication domain in PostHog Cloud
2. SAML SSO configured and working for your domain
3. Identity Provider that supports SCIM 2.0 (e.g., Okta, Entra ID, OneLogin)

Setting up SCIM

1. In PostHog, navigate to Organization settings and go to Authentication domains.

2. Click the (⋯) next to your domain and select Configure SCIM.

3. Copy the SCIM Base URL and SCIM Token. You'll need these for your IdP configuration.

4. In your Identity Provider, configure SCIM for your PostHog application:

   If you already have a SAML app configured and it supports SCIM 2.0 provisioning, you can use that same app. If not, you'll need to create a new app that supports both SAML and SCIM. After setting up SCIM in the new app, migrate your existing SAML configuration and users to it.

   • Set the SCIM Base URL from PostHog
   • Set the Bearer Token (SCIM Token) from PostHog
   • Enable user provisioning

5. Configure role mapping in your IdP. Map your IdP roles to PostHog roles.

6. Assign users and roles to the PostHog application in your IdP, verify that they appear in PostHog.

Example: Okta

If you already have a custom SAML app configured for PostHog, you can enable SCIM provisioning directly on it. If not, first set up SAML following the Okta SAML example, then continue with these steps:

1. In Okta admin, go to Applications and open your PostHog app.

2. Navigate to the Provisioning tab and click Configure API Integration.

3. Check Enable API integration and enter:

   • SCIM Base URL from PostHog
   • API Token (the SCIM Token from PostHog)

   In Unique identifier field for users, enter the Okta attribute that is unique for each provisioned user. This is usually set to the email address, but any unique identifier works.

4. Click Test API Credentials to verify the connection.

5. In the Provisioning to App settings, enable:

   • Create Users
   • Update User Attributes
   • Deactivate Users

6. Go to the Assignments tab and assign the application to users and groups.

   • Click Assign to People and select the users you want to provision into PostHog.
   • Click Assign to Groups and select the Okta groups to provision.

7. Go to the Push Groups tab.

   • To push specific groups, select Find groups by name, then choose Create Group (creates a new role in PostHog) or Link Group (links it to an existing PostHog role). When you link the group to an existing role in PostHog, the role name will be updated to match Okta.
   • If you have lots of groups, you can choose Find groups by rule. This way, all groups matching the rule are pushed to PostHog.
   • Verify the pushed groups show as Active.

   For detailed Okta instructions, see Okta's SCIM provisioning documentation.

Example: OneLogin

If you already have a SAML app configured, you'll need to migrate to an app that supports SCIM provisioning.

1. In OneLogin admin, go to Applications and click Add App.

2. Search for SCIM Provisioner with SAML (SCIM v2 Enterprise, full SAML) and select it.

3. In the Configuration tab, copy the settings from your existing SAML app: SAML Audience URL, RelayState, ACS (Consumer) URL.

4. Go to the Parameters tab and ensure the following attributes are created (they are required for SAML to work correctly):

   • email (Email)
   • first_name (First Name)
   • last_name (Last Name)

5. Navigate to the Configuration tab and paste the SCIM Base URL and SCIM Bearer Token from PostHog into the API Connection section. Click Enable.

6. Go to the Provisioning tab and check Enable provisioning. Select whether you want admin approval for creating or deleting users.

7. To sync roles, go to the Rules tab and create a rule to map OneLogin roles to PostHog roles. To sync all roles as-is:

   • In Actions, select Set Groups in SCIM v2 Provisioner with SAML
   • Select Map from OneLogin
   • For each role with value that matches .*

8. Go to the SSO tab and copy the new Issuer URL, SAML 2.0 Endpoint, and X.509 Certificate. Update your existing SAML configuration in PostHog with these new values.

9. Assign users to the new application. Go to Users, select a user, assign roles, and add them to the application.