SCIM 2.0 Provisioning

Guard implements SCIM 2.0 (RFC 7643/7644), allowing enterprise identity providers (IdPs) such as Okta and Microsoft Entra ID to automatically create, update, and deactivate Guard user accounts. Once configured, your IdP becomes the authoritative source for Guard platform membership and role assignments — no manual account management is required.

How it works

Guard exposes a standards-compliant SCIM 2.0 API. When a user is added to or removed from the relevant group in your IdP, the IdP pushes that change to Guard in real time through this API.

Key behaviors:

• Joiner provisioning — when a user is assigned to the Guard application in your IdP, an account is created in Guard automatically with the role specified by the IdP.

• Role updates — role changes made in the IdP are propagated to Guard without a separate manual step.

• Leaver deprovisioning — when a user is unassigned or deactivated in your IdP, their Guard account is deactivated immediately.

• ExternalId-keyed identity — user records are keyed on the IdP's stable externalId rather than email address. This means identity is preserved across email changes and is compatible with IdPs that do not attest email addresses.

Prerequisites

• A Guard organization with administrator access.

• An enterprise IdP that supports SCIM 2.0 (for example, Okta or Microsoft Entra ID).

• SSO already configured or being configured alongside SCIM (recommended, but not strictly required).

Configure SCIM provisioning

Step 1 — Retrieve your SCIM credentials from Guard

1. In Guard, open Settings and select Authentication.

2. Locate the SCIM Provisioning section.

3. Copy the SCIM base URL and generate or copy the SCIM bearer token. Keep the token secure; it grants the ability to create and deactivate accounts in your organization.

Step 2 — Configure your IdP

The exact steps differ by IdP, but the values you need are the same in every case.

Okta

1. In the Okta Admin Console, open your Guard application and go to the Provisioning tab.

2. Enable SCIM provisioning and enter the base URL and token.

3. Enable Create Users, Update User Attributes, and Deactivate Users under the To App settings.

4. Assign users or groups to the application to trigger initial provisioning.

Microsoft Entra ID

1. In the Entra ID portal, open your Guard enterprise application and go to Provisioning.

2. Set Provisioning Mode to Automatic.

3. Enter the base URL as the Tenant URL and the bearer token as the Secret Token.

4. Click Test Connection to verify, then save and enable provisioning.

Step 3 — Verify provisioning

After saving your IdP configuration:

1. Assign a test user to the Guard application in your IdP.

2. In Guard, navigate to Settings > Members and confirm the user appears with the expected role.

3. Remove the test user from the application in your IdP and confirm the account is deactivated in Guard.

Role mapping

Guard roles are carried in the SCIM payload from your IdP. Configure the role attribute mapping in your IdP to send the appropriate Guard role (for example, member or admin) as part of each user's profile. Refer to your IdP's documentation for attribute mapping instructions.

If no role is specified in the SCIM payload, Guard assigns the default member role.

Security considerations

• Rotate the SCIM token periodically and whenever personnel with access to it change. Generate a new token in Settings > Authentication and update your IdP configuration immediately after.

• The SCIM token grants the ability to provision and deprovision accounts. Store it as a secret in your IdP and do not commit it to source control.

• All SCIM requests are made over HTTPS. HTTP requests are rejected.

Troubleshooting

If an issue persists after following these steps, contact Praetorian support with the SCIM request and response logs from your IdP.