SCIM directory sync

Sync assigned Enterprise SSO users from your identity provider into CodeRabbit.

SCIM lets Okta or Microsoft Entra ID add, update, and deactivate users in your CodeRabbit workspace.

Provisioned users appear in Workspace Team Management, even if they have not signed in to CodeRabbit. You can also map an identity provider group to the CodeRabbit Admin role.

You can configure SCIM as part of your SSO setup.

SSO, SCIM, and seats

These controls solve different parts of user management:

Control	Purpose
SAML SSO	Authenticates users through your identity provider
SCIM	Provisions, updates, and removes workspace members; optionally maps groups to the Admin role
Seat assignment	Determines which member entries have a seat; paid PR reviews require the author’s Git identity to be linked to a seated entry

SCIM does not automatically link a person’s GitHub, GitLab, Bitbucket, or Azure DevOps identities to the provisioned IdP member. Admins can link the corresponding Git identities from Workspace Team Management or with the User Management API. For details, see How IdP members, Git identities, and seats relate.

Before you start

Make sure you have:

• A CodeRabbit Enterprise SSO connection that you are configuring or have already activated
• An identity provider app for CodeRabbit, such as Okta or Microsoft Entra ID
• A CodeRabbit workspace admin role
• Admin access to your identity provider’s SCIM or directory sync settings

Setup flow

1. Open SCIM Settings

   In CodeRabbit, open Workspace Management > SCIM Settings. The page lists the Enterprise SSO connections for the selected workspace.

2. Activate SCIM

   Find the SSO connection you want to synchronize and select Activate SCIM.

3. Copy the endpoint and token

   Copy the SCIM endpoint URL and SCIM bearer token into your identity provider’s provisioning settings. The token is shown only once. If you close it before saving it, select Regenerate token to create a replacement.

4. Enable provisioning in your identity provider

   Enable create, update, and deactivate operations for the CodeRabbit application, then assign the users and groups that should become members of the CodeRabbit workspace.

5. Validate provisioning

   Confirm that assigned users appear in Workspace Team Management. Update a test user in your identity provider and verify that the change reaches CodeRabbit before rolling out SCIM to the full group.

Configure your identity provider

Okta

1. Open the CodeRabbit application in the Okta Admin Console.
2. On General, edit App Settings, set Provisioning to SCIM, and save. Okta adds a Provisioning tab.
3. Open Provisioning > Integration, click Edit, and enter the SCIM endpoint URL and bearer token generated by CodeRabbit.
4. Set Unique identifier field for users to userName.
5. Under Supported provisioning actions, select all available actions: Import New Users and Profile Updates, Push New Users, Push Profile Updates, Push Groups, and Import Groups.
6. Use HTTP Header authentication, enter the authorization value as Bearer <SCIM bearer token>, and save the SCIM connection.
7. Open Provisioning > To App, click Edit, and configure these options:
   • Enable Create Users to provision users when they are assigned to the CodeRabbit application.
   • Enable Update User Attributes to synchronize profile changes.
   • Enable Deactivate Users to deprovision users when they are deactivated or unassigned in Okta.
   • Leave Sync Password disabled because SSO handles authentication.
8. Save the To App settings, assign a test user to the CodeRabbit application, and confirm the user appears in Workspace Team Management.
9. If users were assigned to the Okta application before provisioning was enabled, open Assignments and select Provision User to synchronize those existing assignments.

Deactivate or unassign a user from the CodeRabbit application before deleting the user in Okta. This gives Okta an opportunity to send the SCIM deactivation event.

Microsoft Entra ID

1. Open the CodeRabbit Enterprise application in the Microsoft Entra admin center.
2. Open Provisioning, create a new configuration, and select bearer-token authentication.
3. Paste the CodeRabbit SCIM endpoint URL as the Tenant URL and the SCIM bearer token as the Secret Token.
4. Test the connection, then create the provisioning configuration.

Configure and test the Microsoft Entra provisioning connection

5. Go to Provisioning > Manage > Attribute mapping > Provision Microsoft Entra ID Users.
6. Confirm that the Create, Update, and Delete target-object actions are enabled.
7. Find emails[type eq "work"].value, select Edit, change its source attribute from mail to userPrincipalName, and save the mappings.

The default mail source is often empty for users without an Exchange or Microsoft 365 mailbox. In that case, provisioning fails because an email is required. Mapping the work-email field to userPrincipalName ensures every provisioned user has the identity value CodeRabbit needs.

Verify user actions and edit the work-email attribute mapping

8. Return to the provisioning overview, select Start provisioning, and assign a test user or group to the CodeRabbit Enterprise application.
9. Use Provision on demand when you need to synchronize an existing user immediately.

Microsoft Entra ID normally runs an incremental provisioning cycle about every 40 minutes. A user assigned before provisioning starts may not appear immediately unless you use Provision on demand.

To refresh group provisioning sooner, open the Enterprise application’s Provisioning overview, select Stop provisioning, and then select Start provisioning. Restarting provisioning begins a new initial cycle and can make group changes appear sooner than waiting for the next incremental cycle.

When offboarding a user, disable the user or remove their assignment to the CodeRabbit Enterprise application so Microsoft Entra ID can send the SCIM deactivation event. Deleting the user before that event is sent can leave the existing CodeRabbit membership active.

Map groups to the Admin role

After SCIM is active and your identity provider has pushed its groups, use Group role mapping on the connection card to map a SCIM group to the CodeRabbit Admin role. CodeRabbit currently supports SCIM group mapping for the Admin role only.

If you add more than one mapping, their order controls precedence. The topmost matching group wins for members who belong to multiple mapped groups.

Make groups available to CodeRabbit

Okta

Use the CodeRabbit application’s Push Groups tab to push each group that you want to make available in CodeRabbit.

Microsoft Entra ID

1. Create the security group

   In the Microsoft Entra admin center, open Groups > New group. Create a Security group to synchronize to CodeRabbit and add the appropriate users as direct members.

2. Assign the group to CodeRabbit

   Open Enterprise applications, select the CodeRabbit application, and go to Users and groups > Add user/group. Select the security group and click Assign.

3. Enable group provisioning

   In the CodeRabbit Enterprise application, go to Provisioning > Edit attribute mappings > Mappings. Open Provision Microsoft Entra ID Groups, set Enabled to Yes, and save.

4. Synchronize the group

   Wait for the next provisioning cycle, or return to the Provisioning overview and select Stop provisioning, then Start provisioning, to begin a new cycle. Microsoft Entra ID normally runs an incremental cycle about every 40 minutes.

Microsoft Entra ID does not provision nested groups through SCIM. Assign every group that you want to make available in CodeRabbit directly to the Enterprise application.

Map a synchronized group to Admin

After the groups synchronize, return to Workspace Management > SCIM Settings, select the SCIM group, map it to the Admin role, and save the mapping. Users who do not match an Admin mapping remain workspace members.

Map the synchronized SCIM group to the Admin role

When a user is removed from the mapped Admin identity provider group, CodeRabbit removes the inherited Admin role after the group change synchronizes. The user remains a workspace member if they are still assigned to the CodeRabbit application and active in the identity provider.

Deactivate users with SCIM

To deprovision a user, deactivate the user in your identity provider or remove their assignment to the CodeRabbit application. After the identity provider sends the SCIM deactivation event, CodeRabbit removes the user’s active workspace membership and any Admin role inherited from a mapped identity provider group.

SCIM deactivation removes the IdP member, their linked Git identities, and their seat from Workspace Team Management. If one of those Git identities opens another pull request, CodeRabbit adds it back as a Git-only member. The Git-only member then follows the workspace’s current seat assignment mode.

Manage the connection

• Select Regenerate token when the current token is lost or compromised, then replace the token in your identity provider.
• Select Deactivate to stop provisioning and invalidate the current token. Provisioning remains off until you activate SCIM again.

Deactivating the SCIM connection is different from deactivating a user through SCIM. Deactivating the connection stops future provisioning and does not remove members who were already provisioned. Review existing membership and seats in Workspace Team Management after deactivation.

What’s next

Enterprise SSO overview

Review Enterprise SSO providers, workspace roles, and setup guidance.

Seat assignment

Configure automatic or manual seat assignment for workspace members.

Roles and permissions

Review how workspace roles, organization roles, and custom permissions work with provisioned users.