User and group provisioning

Scalepoint is a SCIM 2.0 service provider. Your identity system can create, update, and deactivate users in Scalepoint automatically, and manage their group memberships, instead of an administrator maintaining them by hand.

There are two ways to connect:

Microsoft Entra ID provisioning — Entra's built-in provisioning service calls Scalepoint on a schedule. This is the recommended option if you use Entra ID.
Any other SCIM 2.0 client — your own integration, or another identity platform, calls the same endpoints directly.

Both use the same endpoints, the same credentials, and the same attribute mapping. Only the configuration on your side differs.

Provisioning is configured independently of single sign-on: federation controls who can sign in, provisioning controls who exists, and you can use either without the other. User names must use one of your organization's registered domains — your default Scalepoint domain always works, and Entra ID federation adds your own domains to the list.

Before you start

Contact Scalepoint to have provisioning enabled for your organization. You will receive:

the SCIM base URL for your organization
a client ID and a client secret

Scalepoint issues these credentials. Ask for sandbox credentials first, verify the integration there, then request production.

Endpoints

Your SCIM base URL follows this pattern, where {tenant} is your organization's tenant identifier at Scalepoint:

Environment	Base URL
Sandbox	`https://sandbox-accounts.scalepoint.com/scim/v2/{tenant}`
Production	`https://accounts.scalepoint.com/scim/v2/{tenant}`

The correct URL is provided to you by Scalepoint.

Two resource types are available under the base URL:

Resource	Path	Schema
Users	`/Users`	`urn:ietf:params:scim:schemas:core:2.0:User`
Groups	`/Groups`	`urn:ietf:params:scim:schemas:core:2.0:Group`

Users also support the enterprise extension, urn:ietf:params:scim:schemas:extension:enterprise:2.0:User, which carries the department, employee number, and manager.

Filtering, sorting, and PATCH are supported.

Authentication

Scalepoint protects the SCIM endpoints with OAuth 2.0 client credentials. Request an access token with the client ID and secret Scalepoint issued you, then send it as a bearer token on every SCIM call. The token endpoint for each environment is listed under Authentication.

Request the token with the scopes you need:

Scope	Required for
`scim:read`	`GET`, `HEAD`, `OPTIONS`
`scim:write`	`POST`, `PUT`, `PATCH`, `DELETE`

A token carrying scim:write is also accepted on reads, so a client that both reads and writes can request both scopes and use one token throughout.

The token is bound to your organization and is rejected against another organization's base URL, so one client can never reach another organization's data.

Tokens are short-lived. Request a new one when the current token expires rather than caching it indefinitely.

Attribute mapping

Users

SCIM attribute	Scalepoint field	Notes
`id`	User ID	Assigned by Scalepoint. Read-only
`externalId`	External ID	Your system's identifier. Map it to the Entra `objectId`
`userName`	User name	Must use one of your organization's registered domains
`displayName`	Name
`name.givenName`, `name.familyName`, `name.middleName`, `name.formatted`	Name parts
`title`	Job title
`active`	Login allowed	`false` prevents sign-in
`preferredLanguage`	Locale	Falls back to your organization's default when absent or unreadable
`emails[type eq "work"]`	Email	Also marks the address as confirmed
`phoneNumbers[type eq "mobile"]`	Mobile phone
`phoneNumbers[type eq "work"]`	Secondary phone
`addresses[type eq "work"]`	Address
`groups`	Security group membership	Values are Scalepoint group IDs. Usually managed through the Groups resource's `members` attribute instead — Entra does it that way
`roles`	Effective roles	Read-only. Managed in Scalepoint

The type qualifiers are significant. An email sent as type: "other", or a phone number sent as type: "home", is not mapped.

From the enterprise extension:

SCIM attribute	Scalepoint field
`department`	Department group
`employeeNumber`	Employee number
`manager`	Manager

A department group is created automatically the first time a department value arrives, and the user is added to it.

Groups

SCIM attribute	Scalepoint field
`id`	Group ID. Assigned by Scalepoint
`displayName`	Group name
`members`	Group membership

Only security groups are provisioned. Department groups are derived from the user's department attribute instead.

If you also federate sign-in with Entra ID, note that group aliases in Scalepoint must match the Entra group object ID for role mapping to work. See group mapping on the SSO page.

Deactivation and deletion

Scalepoint never deletes an account through SCIM.

Setting active to false, or sending DELETE /Users/{id}, has the same effect: the account can no longer sign in, but the record and its history are kept. Setting active back to true restores access.

This is deliberate. Accounts are referenced by cases and other records that must remain auditable after a person leaves.

Groups are different: deleting a group removes it and its memberships from Scalepoint. The users in it are not affected.

Concurrency

Every user resource carries a version in meta.version, returned as an ETag header.

Send it back as If-Match on updates. If the record changed since you read it, the request is rejected instead of silently overwriting the other change. Clients that do not send If-Match are accepted, and last write wins.

Troubleshooting

Symptom	Likely cause
`401 Unauthorized`	Token missing, expired, or issued by a different environment
`403 Forbidden` on every call	The client is not authorized for this organization, the token's scope is missing, or the base URL names a different tenant than the token
`403 Forbidden` on writes only	The token has `scim:read` but not `scim:write`
A user is created twice after being renamed	`externalId` is mapped to something other than the Entra object ID
Group memberships are missing	The group is not assigned to the provisioning application, or the user belongs to it only through a nested group
The user name is rejected	The domain is not one of your organization's registered domains — note that a disabled federation's domains do not count
Entra provisioning is in quarantine	Repeated failures. Fix the underlying error, then select Restart provisioning

When you contact Scalepoint about a provisioning problem, include the time of the failure, the affected user's externalId, and the response your client received.