> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# SCIM

## SCIM

###### Where is this feature available?

##### Free / Open-source

##### Paid

##### Boost

##### Scale

##### Enterprise

![Not available](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyMCIgaGVpZ2h0PSIyMCIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDIwIDIwIj48cGF0aCBmaWxsPSIjRkI0RjBEIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMC4wNjQyIDcuODE5Nkw0LjI0NDU5IDJMMiA0LjI0NDU5TDcuODE5NiAxMC4wNjQyTDIuMTI4MzcgMTUuNzU1NEw0LjM3Mjk2IDE4TDEwLjA2NDIgMTIuMzA4OEwxNS40Njc1IDE3LjcxMjFMMTcuNzEyMSAxNS40Njc1TDEyLjMwODggMTAuMDY0MkwxNy44NDA1IDQuNTMyNDhMMTUuNTk1OSAyLjI4Nzg5TDEwLjA2NDIgNy44MTk2WiIgY2xpcC1ydWxlPSJldmVub2RkIi8+PC9zdmc+)![Not available](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyMCIgaGVpZ2h0PSIyMCIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDIwIDIwIj48cGF0aCBmaWxsPSIjRkI0RjBEIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMC4wNjQyIDcuODE5Nkw0LjI0NDU5IDJMMiA0LjI0NDU5TDcuODE5NiAxMC4wNjQyTDIuMTI4MzcgMTUuNzU1NEw0LjM3Mjk2IDE4TDEwLjA2NDIgMTIuMzA4OEwxNS40Njc1IDE3LjcxMjFMMTcuNzEyMSAxNS40Njc1TDEyLjMwODggMTAuMDY0MkwxNy44NDA1IDQuNTMyNDhMMTUuNTk1OSAyLjI4Nzg5TDEwLjA2NDIgNy44MTk2WiIgY2xpcC1ydWxlPSJldmVub2RkIi8+PC9zdmc+)![Not available](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyMCIgaGVpZ2h0PSIyMCIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDIwIDIwIj48cGF0aCBmaWxsPSIjRkI0RjBEIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMC4wNjQyIDcuODE5Nkw0LjI0NDU5IDJMMiA0LjI0NDU5TDcuODE5NiAxMC4wNjQyTDIuMTI4MzcgMTUuNzU1NEw0LjM3Mjk2IDE4TDEwLjA2NDIgMTIuMzA4OEwxNS40Njc1IDE3LjcxMjFMMTcuNzEyMSAxNS40Njc1TDEyLjMwODggMTAuMDY0MkwxNy44NDA1IDQuNTMyNDhMMTUuNTk1OSAyLjI4Nzg5TDEwLjA2NDIgNy44MTk2WiIgY2xpcC1ydWxlPSJldmVub2RkIi8+PC9zdmc+)![Not available](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyMCIgaGVpZ2h0PSIyMCIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDIwIDIwIj48cGF0aCBmaWxsPSIjRkI0RjBEIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMC4wNjQyIDcuODE5Nkw0LjI0NDU5IDJMMiA0LjI0NDU5TDcuODE5NiAxMC4wNjQyTDIuMTI4MzcgMTUuNzU1NEw0LjM3Mjk2IDE4TDEwLjA2NDIgMTIuMzA4OEwxNS40Njc1IDE3LjcxMjFMMTcuNzEyMSAxNS40Njc1TDEyLjMwODggMTAuMDY0MkwxNy44NDA1IDQuNTMyNDhMMTUuNTk1OSAyLjI4Nzg5TDEwLjA2NDIgNy44MTk2WiIgY2xpcC1ydWxlPSJldmVub2RkIi8+PC9zdmc+)![Available](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyOCIgaGVpZ2h0PSIyOCIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDI4IDI4Ij48cGF0aCBmaWxsPSIjNzFBQTU1IiBkPSJNOS41MTAwMyAyNC4wMjk5TDAuNDEwMDMzIDE0LjkyOTlDLTAuMTM2Njc4IDE0LjM4MzIgLTAuMTM2Njc4IDEzLjQ5NjggMC40MTAwMzMgMTIuOTVMMi4zODk4OCAxMC45NzAxQzIuOTM2NiAxMC40MjMzIDMuODIzMDggMTAuNDIzMyA0LjM2OTc5IDEwLjk3MDFMMTAuNSAxNy4xMDAyTDIzLjYzMDIgMy45NzAwOUMyNC4xNzY5IDMuNDIzMzggMjUuMDYzNCAzLjQyMzM4IDI1LjYxMDEgMy45NzAwOUwyNy41ODk5IDUuOTVDMjguMTM2NyA2LjQ5NjcxIDI4LjEzNjcgNy4zODMxNCAyNy41ODk5IDcuOTI5OUwxMS40ODk5IDI0LjAzQzEwLjk0MzIgMjQuNTc2NyAxMC4wNTY3IDI0LjU3NjcgOS41MTAwMyAyNC4wMjk5VjI0LjAyOTlaIi8+PC9zdmc+)

SCIM enables you to automatically sync users and their roles from your identity provider (IdP) into PostHog. This is useful for automatically creating accounts and assigning roles when someone joins your organization, and disabling accounts when they leave.

### How SCIM works

-   Assigning a user to the SCIM app in your IdP creates them in PostHog with the mapped role.
-   Removing a user from the app deactivates their PostHog account.
-   Users with matching emails in PostHog are updated to match the IdP details and roles.
-   Roles are matched by name (case-sensitive).
-   SCIM configuration changes (enabling, disabling, token rotation) are recorded in the [activity log](/docs/settings/activity-logs.md).

### Prerequisites

Before setting up SCIM, you need:

1.  Verified authentication domain in PostHog Cloud
2.  SAML SSO configured and working for your domain
3.  Identity Provider that supports SCIM 2.0 (e.g., Okta, Entra ID, OneLogin)

### Setting up SCIM

1.  In PostHog, navigate to Organization settings and go to [Authentication domains](https://app.posthog.com/settings/organization-authentication).

2.  Click the **(⋯)** next to your domain and select **Configure SCIM**.

3.  Copy the **SCIM Base URL** and **SCIM Token**. You'll need these for your IdP configuration.

4.  In your Identity Provider, configure SCIM for your PostHog application:

    If you already have a SAML app configured and it supports SCIM 2.0 provisioning, you can use that same app. If not, you'll need to create a new app that supports both SAML and SCIM. After setting up SCIM in the new app, migrate your existing SAML configuration and users to it.

    -   Set the SCIM Base URL from PostHog
    -   Set the Bearer Token (SCIM Token) from PostHog
    -   Enable user provisioning
5.  Configure role mapping in your IdP. Map your IdP roles to PostHog roles.

6.  Assign users and roles to the PostHog application in your IdP, verify that they appear in PostHog.

### Example: Okta

If you already have a custom SAML app configured for PostHog, you can enable SCIM provisioning directly on it. If not, first set up SAML following the [Okta SAML example](#example-okta), then continue with these steps:

1.  In Okta admin, go to **Applications** and open your PostHog app.

2.  Navigate to the **Provisioning** tab and click **Configure API Integration**.

3.  Check **Enable API integration** and enter:

    -   **SCIM Base URL** from PostHog
    -   **API Token** (the SCIM Token from PostHog)

    In **Unique identifier field for users**, enter the Okta attribute that is unique for each provisioned user. This is usually set to the email address, but any unique identifier works.

4.  Click **Test API Credentials** to verify the connection.

5.  In the **Provisioning to App** settings, enable:

    -   Create Users
    -   Update User Attributes
    -   Deactivate Users
6.  Go to the **Assignments** tab and assign the application to users and groups.

    -   Click **Assign to People** and select the users you want to provision into PostHog.
    -   Click **Assign to Groups** and select the Okta groups to provision.
7.  Go to the **Push Groups** tab.

    -   To push specific groups, select **Find groups by name**, then choose **Create Group** (creates a new role in PostHog) or **Link Group** (links it to an existing PostHog role). When you link the group to an existing role in PostHog, the role name will be updated to match Okta.
    -   If you have lots of groups, you can choose **Find groups by rule**. This way, all groups matching the rule are pushed to PostHog.
    -   Verify the pushed groups show as **Active**.

    For detailed Okta instructions, see [Okta's SCIM provisioning documentation](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_scim.htm).

### Example: OneLogin

If you already have a SAML app configured, you'll need to migrate to an app that supports SCIM provisioning.

1.  In OneLogin admin, go to **Applications** and click **Add App**.

2.  Search for `SCIM Provisioner with SAML (SCIM v2 Enterprise, full SAML)` and select it.

3.  In the **Configuration** tab, copy the settings from your existing SAML app: SAML Audience URL, RelayState, ACS (Consumer) URL.

4.  Go to the **Parameters** tab and ensure the following attributes are created (they are required for SAML to work correctly):

    -   `email` (Email)
    -   `first_name` (First Name)
    -   `last_name` (Last Name)
5.  Navigate to the **Configuration** tab and paste the **SCIM Base URL** and **SCIM Bearer Token** from PostHog into the API Connection section. Click **Enable**.

6.  Go to the **Provisioning** tab and check **Enable provisioning**. Select whether you want admin approval for creating or deleting users.

7.  To sync roles, go to the **Rules** tab and create a rule to map OneLogin roles to PostHog roles. To sync all roles as-is:

    -   In **Actions**, select `Set Groups in SCIM v2 Provisioner with SAML`
    -   Select `Map from OneLogin`
    -   For each `role` with value that matches `.*`
8.  Go to the **SSO** tab and copy the new **Issuer URL**, **SAML 2.0 Endpoint**, and **X.509 Certificate**. Update your existing SAML configuration in PostHog with these new values.

9.  Assign users to the new application. Go to **Users**, select a user, assign roles, and add them to the application.

### Still have questions?

Ask PostHog AI

### Was this page useful?

HelpfulCould be better