Skip to content
SafeHanded Docs

Automatic provisioning (SCIM)

On the Team plan and above, your identity provider can add and remove SafeHanded members for you over SCIM 2.0. Joiners get a membership, leavers are disabled, and the groups your provider pushes can set each member’s role. For: Admins and Owners.

Set it up

Section titled “Set it up”
  1. Connect the provider for sign-in first (SAML, OpenID Connect or the built-in Microsoft connection).
  2. Open its card under Settings → Integrations, go to the SCIM tab and choose Issue token & show steps. Copy the Tenant URL and the token (shown once; rotate it to see a new one). Issuing or rotating a token needs your vault open in this browser; SafeHanded asks you to unlock it if it isn’t.
  3. In your provider, paste the Tenant URL and token, following the steps below for your provider.

How SafeHanded treats provisioning

Section titled “How SafeHanded treats provisioning”
  • New users get a membership with the connection’s default role. For an email address in one of your verified domains (Settings → Verification), someone who already has a SafeHanded account joins straight away and anyone else gets a membership they claim the first time they sign in; no invitation email is sent. For any other address, SafeHanded sends an ordinary invitation the person must accept (it expires like any invitation), because your provider can only vouch for addresses in domains you have proved you own.
  • Which members your provider manages: the members it provisioned, plus anyone already a member whose address is in a verified domain (your provider takes them over on its first change). It can’t see, disable or regroup members added by hand under other addresses, or members another connection manages; manage those in SafeHanded.
  • Leavers: setting a user inactive, unassigning or deleting them disables the membership. That only blocks access: nothing is lost, and assigning or activating them again brings everything back. To hand over their requests for good, offboard them in SafeHanded.
  • Your provider only enables people it disabled, never someone an Admin disabled or offboarded in SafeHanded. Owners are never disabled over SCIM (change their role in SafeHanded first), so a mistake in your provider can’t lock the organisation out.
  • Timing: your provider sends changes on its own schedule (Microsoft Entra about every 40 minutes). To push one now, use Provision on demand in Entra.
  • People who haven’t signed in yet: anyone your provider pushes is already a member. Without SCIM, see Not signed in yet.
  • Seats: your plan’s seat limit applies. A user that would go over it is refused with an error your provider shows.
  • Groups: a pushed group can set a role through the group → role editor (provision by group). A group is matched by the ID your provider sends (its externalId), or by its name when your provider sends no ID.
  • Renames: a new email is followed only until the person first signs in. After that, their email is their own SafeHanded account’s. A rename to an address outside your verified domains sends that address an invitation to accept.

Provider steps

Section titled “Provider steps”

Okta has been tested end to end. The steps for the others are checked against each provider’s own documentation; if what you see doesn’t match, email support@safehanded.com.

Okta

Section titled “Okta”

Enable Provisioning: SCIM on the app. Use userName as the unique identifier and HTTP Header authentication (the token), and turn on Create Users, Update User Attributes and Deactivate Users under To App. Okta sends no ID with a pushed group, so map groups by their name.

Microsoft Entra ID

Section titled “Microsoft Entra ID”
  1. In Enterprise applications, open the SafeHanded app (or create a non-gallery one), open Provisioning and set the mode to Automatic.
  2. Tenant URL: SafeHanded’s Tenant URL, which already ends in ?aadOptscim062020 (the switch Microsoft recommends for standard SCIM behaviour). Secret token: the SafeHanded token.
  3. Choose Test Connection, then set the scope to Sync only assigned users and groups and assign the people and groups who need SafeHanded.
  4. Keep the matching attribute as userName ↔ userPrincipalName, and make sure each person’s UPN is the email they sign in with.
  5. Map groups to roles by the group’s Object ID (Entra sends it as the group ID). Nested groups aren’t provisioned.

Entra runs a provisioning cycle about every 40 minutes, so changes aren’t instant (Provision on demand pushes one person now). Unassigning someone disables their membership, which is reversible.

JumpCloud

Section titled “JumpCloud”
  1. Create or open the SSO application and go to Identity Management. Choose SCIM 2.0.
  2. Base URL: the Tenant URL, without the ?aadOptscim062020 part. Token: the SafeHanded token.
  3. JumpCloud’s activation test creates, updates and deletes a test user: give it an address that isn’t already a member. It is left behind as a disabled membership, and it needs a free seat while the test runs.
  4. Users are provisioned only through user groups bound to the application.
  5. Map groups to roles by the ID JumpCloud sends, or by the group name if it sends none. The provisioned groups appear in the group → role editor once JumpCloud has pushed them.

OneLogin

Section titled “OneLogin”
  1. Use the SCIM Provisioner with SAML (SCIM v2 Core) connector.
  2. SCIM Base URL: the Tenant URL, without the ?aadOptscim062020 part. SCIM Bearer Token: the SafeHanded token.
  3. Under Provisioning, turn on provisioning with Create user, Update user and Delete user, and set the action on deletion to Suspend, not Delete.
  4. For groups, turn on Include in User Provisioning for the Groups parameter, add a rule that sets groups in the app, then Reapply entitlement mappings.
  5. Deleting a group in OneLogin doesn’t reach SafeHanded, so remove its role mapping yourself.
Section titled “Related”