SCIM
termsecuritynetworking
System for Cross-domain Identity Management: the open standard for provisioning - creating, updating, grouping, and deactivating user accounts across systems over a JSON REST API, with schemas from RFC 7643 and the protocol from RFC 7644.
SAML and OIDC sign an account in; SCIM is how the account got there and how it is switched off the day the person leaves.
SCIM is the protocol that keeps user accounts in step across systems, and it exists because single sign-on solved authentication without solving provisioning. Federation lets someone log in; it does not create their account, set their group memberships, or remove them on the day they leave.
That last one is why SCIM matters more than it appears. Orphaned accounts after a departure are among the most reliable findings in any access review, and manual deprovisioning across a dozen applications fails quietly because nobody notices an account that still works. Automated deprovisioning turns an offboarding checklist into an event the identity provider emits.
The friction is in the details rather than the concept. The specification defines a core schema, and providers extend it, so attribute mapping between two systems that both claim SCIM support is usually where the work lands. Group synchronization semantics differ between implementations, and a mapping that looks correct can assign the wrong entitlements silently, which is why the first sync should be run against a small pilot group rather than the whole directory.
Also known as: System for Cross-domain Identity Management, SCIM 2.0