# SCIM provisioning

URL: /security/scim

Keep Foxborne's member list in step with your identity provider. With SCIM on, adding someone to a Foxborne group adds them here, and removing them upstream removes them within five minutes.



Offboarding should happen once, in the directory your organization already trusts. With SCIM on, Foxborne follows your identity provider: removing someone there removes them here within five minutes. Five groups in the identity provider line up with Foxborne's five roles.

## Before you start [#before-you-start]

* You need the **Admin** role. Only admins hold **Manage hosting, keys and access**.
* [Single sign-on](/security/sso) is set up with your identity provider.
* You can create groups in your identity provider and change who belongs to them.

## Read the Provisioning panel [#read-the-provisioning-panel]

Go to **Access** and open the **Sign-in** tab. The **Provisioning** panel carries the chip **SCIM on** and two rows.

| Row           | What it shows                                                                                                 |
| ------------- | ------------------------------------------------------------------------------------------------------------- |
| **Last sync** | When Foxborne last synchronized with your identity provider, as a relative time                               |
| **Groups**    | `foxborne-admins`, `foxborne-investigators`, `foxborne-reviewers`, `foxborne-viewers` and `foxborne-auditors` |

The panel has nothing to edit. Group membership lives in your identity provider, and Foxborne follows it.

## Groups and roles [#groups-and-roles]

The five group names match the five roles one to one.

| Group in your identity provider | Role in Foxborne |
| ------------------------------- | ---------------- |
| `foxborne-admins`               | Admin            |
| `foxborne-investigators`        | Investigator     |
| `foxborne-reviewers`            | Reviewer         |
| `foxborne-viewers`              | Viewer           |
| `foxborne-auditors`             | Auditor          |

[Roles and permissions](/security/roles) lists what each role may do.

## Provision people [#provision-people]

<Steps>
  <Step title="Create the five groups">
    In your identity provider, create the five groups. Use the names exactly as the **Provisioning** panel lists them.
  </Step>

  <Step title="Add people to their group">
    Add each person to the group for the role they need. With SCIM on, this does the same job as **Invite** in the console. The **Invite someone** dialog says so: &#x2A;*With SCIM on, adding them to a Foxborne group in the identity provider also works.**

    Assign the same groups to the Foxborne SAML application, so their members can sign in.
  </Step>

  <Step title="Check the sync">
    On **Access**, **Sign-in**, **Last sync** shows when Foxborne last synchronized. The audit log records each sync as **Synced users** on **SCIM**, by **System**, with a detail such as **9 users, 5 groups, no changes**.
  </Step>

  <Step title="Check the members">
    Open the **Members** tab. Each person appears with the role their group matches and **Single sign-on** under **Sign-in**. The note under the table reads &#x2A;*Removing someone in the identity provider removes them here within five minutes.**
  </Step>
</Steps>

## Remove someone [#remove-someone]

Remove the person in your identity provider. Foxborne removes them within five minutes, with no second list to clean up.

Their audit entries stay. The audit log is append-only and never deleted, so every action they took remains attributed to them.

For an immediate cut-off, also use **Remove access** on **Members**: &#x2A;*They lose access at once.** See [Remove access](/security/manage-access#remove-access).

## SCIM and the console [#scim-and-the-console]

The same three tasks can start in either place.

| Task           | In your identity provider                             | In the console                                            |
| -------------- | ----------------------------------------------------- | --------------------------------------------------------- |
| Add someone    | Add them to a Foxborne group                          | **Invite**                                                |
| Change a role  | Move them to the matching group                       | **Change role**, which takes effect on their next request |
| Remove someone | Remove them, and Foxborne follows within five minutes | **Remove access**, which cuts access at once              |

With SCIM on, keep the identity provider as the record: a change made only in the console leaves the two lists apart.

## Check the result [#check-the-result]

* **Last sync** shows a recent time.
* The audit log has a recent **Synced users** entry. Type `SCIM` in **Filter by person, action or object** to find it.
* The **Members** table matches the membership of the five groups.

## Troubleshoot [#troubleshoot]

**A new person is missing from Members.** Check that they belong to one of the five groups, spelled exactly as the panel shows it. Then check **Last sync** and the latest **Synced users** entry, or invite them from the console with **Invite**.

**Someone removed upstream is still listed after five minutes.** Look for a recent **Synced users** entry in the audit log. Use **Remove access** to stop their access at once while you find out why.

**A person holds the wrong role.** Compare the **Role** column on **Members** with the Foxborne group that holds them in your identity provider. The group names match the roles.

## Next [#next]

* [Invite, change and remove access](/security/manage-access) covers the console side of membership.
* [Single sign-on](/security/sso) connects the identity provider the groups come from.
* [Audit log](/security/audit-log) lists the **Synced users** entry and every other action.