SCIM Provisioning

SCIM 2.0 lets your identity provider manage your team's Zernio accounts the way it manages everything else: joiners are provisioned automatically, attribute changes sync, and leavers lose access the moment IT offboards them. No invites to send, no manual removals to remember.

SCIM comes with an Enterprise agreement and builds on single sign-on: provisioning access is scoped to your DNS-verified SSO connection, so it can only ever touch accounts at your own domain.

Connecting your IdP

Point your identity provider's provisioning integration (Okta, Microsoft Entra, and anything else that speaks SCIM 2.0) at:

The bearer token is issued to the workspace owner during Enterprise onboarding, the same person who controls the SSO connection, and is rotated on request. Tokens are stored hashed on our side and are scoped to your connection: a token can only ever provision into the workspace behind it.

What provisioning does

• Create: a person pushed from your directory lands in your workspace with the SSO connection's default role, covered by your workspace's plan. Their email is treated as verified, since your IdP owns the address. The owner role can never be assigned this way.
• Update: attribute changes in your directory sync to the Zernio account.
• Deactivate: active: false from your IdP shuts the account down. Every sign-in path refuses a deactivated user, so offboarding in your directory is offboarding in Zernio. Reactivating in the IdP restores access.

Employees who already have a Zernio account

If someone at your domain signed up before SCIM was connected, provisioning links their existing account instead of failing the sync: the link is allowed exactly when their email is at your DNS-verified domain, the same ownership proof SSO trusts. After linking, your IdP controls their lifecycle (including deactivation). Their own workspace, data, and billing are left untouched; linking does not move them into your workspace.

SCIM and SSO together

SCIM manages the accounts; SSO signs them in. The usual Enterprise setup is both: provisioning from the directory, sign-in through the IdP, and enforcement turned on so no one at the domain can side-step either.