Configure automatic user and group provisioning with SCIM

Reviewed on February 05, 2026

System for Cross-domain Identity Management (SCIM) is a standard protocol for exchanging user, group and group membership identity and authorization data between an Identity Provider (IdP) and a Service Provider.

Combined with SAML, SCIM allows IAM administrators to manage the full authentication and identity lifecycle of the users, groups, and group memberships through their Identity Provider:

• SAML is used for members to log in by authenticating on their Identity Provider with the IdP-defined authentication policies.
• SCIM is used to automatically update Scaleway users, groups, and group memberships based on actions performed on the Identify Provider directory.

Supported SCIM features

SCIM supports the following operations managed directly from the Identity Provider:

• User management: Create, update, lock, unlock, and delete user accounts.
• Group management: Create, update, and delete IAM groups. Nested groups (groups within groups) are not supported.
• Group membership: Add and remove users from IAM groups.

Before you start

To complete the actions presented below, you must have:

• A Scaleway account logged into the console (External link)
• Owner status or IAM permissions allowing you to perform actions in the intended Organization

Enable SCIM

1. In the upper-right corner of the Organization Dashboard, click the Settings button. The Organization Settings (External link) opens. Alternatively, in the upper-right corner of the header navigation, click the avatar icon then select Settings on the dropdown.

2. In the side menu, go to Organization security > Automatic user provisioning (SCIM). The SCIM section opens.

3. Click the Enable button. A dialog box appears, requiring the creation of a token to enable SCIM.

4. Click the Enable SCIM and create token button. SCIM is now enabled for the Organization, and the following credentials appear:

   • A SCIM token, which is used by the Identity Provider to authenticate to Scaleway and perform the necessary actions. This token is sensitive, keep it secure and do not share it with anyone.
   • A base URL, which is used by the Identity Provider to connect to the Scaleway account.
   Important

   Both the SCIM token and the base URL are only displayed once. Copy and safely store them before closing the dialog box. You will need them to set up SCIM with your Identity Provider.

5. Click Close. The configuration is complete on Scaleway side. You must continue the SCIM setup on your Identity provider.

   To check if your SCIM configuration is correct, you can perform actions such as changing a name or creating a user directly on your Identity Provider. You should then see:

   • The impacts reflected on your Scaleway users (External link)
   • The update events listed in the Paris region of your Audit Trail dashboard (External link)

By default, SCIM manages users only if their usernames match between the Identity Provider and Scaleway. The federation compares users from both sources, and users not found in the Identity Provider are not impacted by SCIM configuration. If you wish to manage not-found users via SCIM, you must re-create them on the Identity Provider or change settings on the Identity Provider side.

Depending on the provider, changes might take from a few seconds to up to 30 minutes to be synchronized. This delay cannot be modified by Scaleway.

Rotate a SCIM token

You can have up to two active SCIM tokens at a time. To create a second token:

1. In the upper-right corner of the Organization Dashboard, click the Settings button. The Organization Settings (External link) page opens.
2. In the side menu, go to Organization security > Automatic user provisioning (SCIM). The SCIM section opens.
3. Click Generate token. A dialog box appears.
4. Follow the previous How to enable SCIM steps, but replace the previous SCIM token with the new one on your Identity Provider.
5. Check if the SCIM configuration is still working.
6. (Optional) You can delete the previous token if no longer necessary.

SCIM tokens have a time-to-live of 1 year. When a token expires, you can no longer use it to provision users, you need to create a new token to maintain SCIM synchronization.

Disable SCIM

1. In the upper-right corner of the Organization Dashboard, click the Settings button. The Organization Settings (External link) page opens.
2. In the side menu, go to Organization security > Automatic user provisioning (SCIM). The SCIM section opens.
3. Click Disable button.
4. Type Disable to confirm.
   Important

   If SCIM is disabled on Scaleway, your Identity Provider will no longer be able to perform any actions on users, even if the configuration is correctly done on this side.