Overig · Overig
Understanding SCIM: the backbone of modern IAM provisioning
What is SCIM and why is it so important for identity provisioning? In this blog, we explain how SCIM works, why more and more SaaS applications support it, and how platforms like Joinly use it to enable HR-driven IAM automation.
Morten Broers · IAM Developer · 8 min read
In modern organisations, Identity & Access Management (IAM) is indispensable. Employees have access to dozens of applications, from Microsoft 365 to Slack and AFAS.
Manually creating, modifying, and deleting accounts is time-consuming and leads to errors.
That's why more organisations are using SCIM provisioning: a standardised method to automatically synchronise identities between systems.
But what is SCIM exactly, and why has it become so crucial in every IAM strategy?
What is SCIM?
SCIM stands for System for Cross-Domain Identity Management.
It's an open standard that defines how user information is automatically exchanged between identity systems (such as Microsoft Entra ID) and applications (such as Slack or Zoom).
In simple terms: SCIM tells an app who someone is and what they are allowed to do, and keeps that automatically up-to-date.
Key features:
Based on REST APIs and JSON data formats
Supports CRUD operations (Create, Read, Update, Delete)
Standardised attributes such as
userName,emails,name,groupsIncludes endpoint definitions such as
/Usersand/Groups
How SCIM provisioning works
SCIM provisioning operates under a pull or push model:
An identity provider (IdP) such as Microsoft Entra ID, Okta or JumpCloud keeps track of which users are active.
A service provider (SP) like Slack or Zoom automatically receives updates via the SCIM endpoint.
When someone joins or leaves, the IdP sends a standardised SCIM payload to the SP.
Why SCIM is important for IAM
Without SCIM, organisations must automate provisioning themselves via APIs or scripts, which is complex, error-prone, and maintenance-intensive. SCIM makes this uniform, secure, and scalable.
Benefits of SCIM provisioning:
Consistency: the same identity in every system
Automation: no more manual management
Security: immediate deactivation upon departure
Compliance: audit trails and traceable source data
With SCIM, organisations can synchronise thousands of users without human intervention.
SCIM and Microsoft Entra ID
Microsoft Entra ID (formerly Azure AD) supports SCIM for the automatic creation and deletion of users in linked SaaS apps (we can connect almost any conceivable system). Through the Entra portal, you can easily set up a “Provisioning URL” and “Bearer Token” for an external application.
Practical example:
Joinly provides a SCIM endpoint
Entra ID automatically connects and sends changes from HR.
Joinly translates this data to the appropriate users and permissions in connected systems.
How Joinly uses SCIM
Joinly uses SCIM as the backbone of its provisioning architecture.
The platform acts as an intermediary between HR systems and Entra ID, allowing HR changes to flow directly to all applications.
HR → Joinly (HR data via API or file)
Joinly → Entra ID (via SCIM provisioning)
Entra ID → Joinly SCIM Gateway → SaaS apps (such as M365, Slack, HubSpot)
This creates a fully automated joiner-mover-leaver flow without manual management.
Future of SCIM
Although SCIM is already widely supported, the standard continues to develop.
New versions will support more contextual data (such as roles and organisational structures).
AI-driven provisioning, like Joinly's Role Mining AI, builds on the same SCIM structure.
Conclusion
SCIM is the silent engine behind modern identity automation.
It ensures that every HR change automatically leads to safe, consistent access across all systems.
Recommended further reading:
Explore more blogs
Segregation of Duties (SoD): wat het is en hoe je het afdwingt
Wat is segregation of duties (functiescheiding)? Uitleg, voorbeelden en waarom het vaak misgaat. Plus hoe je SoD-conflicten automatisch tegenhoudt.
Marcel van Beek · 4 min read
How do you apply AGDLP in a hybrid Entra/AD environment? (And why you shouldn't want to anymore)
Short answer: preferably not. AGDLP (Accounts → Global groups → Domain Local groups → Permissions) is a concept from the era of manual management. The entire nesting construction exists for one reason: to allow a human to assign permissions with as few mouse clicks as possible. As soon as an agent assigns group memberships directly based on HR data, this reason disappears and only the complexity remains. Moreover, in a hybrid environment, this complexity actively works against you, because Entra ID completely ignores nesting for licences and app assignment. In this article, you can read how AGDLP works and why it was once smart, where it breaks down in a hybrid environment, and what the modern alternative looks like: direct memberships, managed by automation.
Marcel van Beek · 5 min read
How do I set up role-based access control (RBAC) and least privilege for a municipality?
Start with the roles in your HR system and map them to roles, not to individual permissions per person. Group each role with precisely the access required for the job, adhering to the principle of least privilege. Manage these roles centrally and let an orchestration layer automatically assign and revoke them. This keeps access predictable, limited and demonstrable.
Mike Fraanje · 4 min read
See what Joinly can do for your organisation?
Start a free trial today or get in touch for advice on your HR and Microsoft environment.