> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# SCIM directory sync
> Sync assigned Enterprise SSO users from your identity provider into CodeRabbit.
export const EnterprisePlanBadge = ({tip = "This feature is available exclusively as part of the Enterprise plan. Please refer to our pricing page for more information about our plans and features.", title = "Enterprise Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
return
{title}
;
};
export const AdminRoleBadge = ({tip = "This feature requires an organization owner, an admin role or the corresponding permission. Regular Members do not have access.", title = "Admin Only", cta = "View roles", href = "/management/roles", disabled = false}) => {
return
{title}
;
};
SCIM lets Okta or Microsoft Entra ID add, update, and deactivate users in your CodeRabbit workspace.
Provisioned users appear in **Workspace Team Management**, even if they have not signed in to CodeRabbit. You can also map an identity provider group to the CodeRabbit Admin role.
You can configure SCIM as part of your SSO setup.
## SSO, SCIM, and seats
These controls solve different parts of user management:
| Control | Purpose |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| SAML SSO | Authenticates users through your identity provider |
| SCIM | Provisions, updates, and removes workspace members; optionally maps groups to the Admin role |
| Seat assignment | Determines which member entries have a seat; paid PR reviews require the author's Git identity to be linked to a seated entry |
SCIM does not automatically link a person's GitHub, GitLab, Bitbucket, or Azure DevOps identities to the provisioned IdP member. Admins can link the corresponding Git identities from **Workspace Team Management** or with the User Management API. For details, see [How IdP members, Git identities, and seats relate](/management/seat-assignment#how-idp-members-git-identities-and-seats-relate).
## Before you start
Make sure you have:
* A CodeRabbit Enterprise SSO connection that you are configuring or have already activated
* An identity provider app for CodeRabbit, such as Okta or Microsoft Entra ID
* A CodeRabbit workspace admin role
* Admin access to your identity provider's SCIM or directory sync settings
## Setup flow
In CodeRabbit, open **Workspace Management** > **SCIM Settings**. The page lists the Enterprise SSO connections for the selected workspace.
Find the SSO connection you want to synchronize and select **Activate SCIM**.
Copy the **SCIM endpoint URL** and **SCIM bearer token** into your identity provider's provisioning settings. The token is shown only once. If you close it before saving it, select **Regenerate token** to create a replacement.
Enable create, update, and deactivate operations for the CodeRabbit application, then assign the users and groups that should become members of the CodeRabbit workspace.
Confirm that assigned users appear in **Workspace Team Management**. Update a test user in your identity provider and verify that the change reaches CodeRabbit before rolling out SCIM to the full group.
## Configure your identity provider
1. Open the CodeRabbit application in the Okta Admin Console.
2. On **General**, edit **App Settings**, set **Provisioning** to **SCIM**, and save. Okta adds a **Provisioning** tab.
3. Open **Provisioning** > **Integration**, click **Edit**, and enter the SCIM endpoint URL and bearer token generated by CodeRabbit.
4. Set **Unique identifier field for users** to `userName`.
5. Under **Supported provisioning actions**, select all available actions: **Import New Users and Profile Updates**, **Push New Users**, **Push Profile Updates**, **Push Groups**, and **Import Groups**.
6. Use **HTTP Header** authentication, enter the authorization value as `Bearer `, and save the SCIM connection.
7. Open **Provisioning** > **To App**, click **Edit**, and configure these options:
* Enable **Create Users** to provision users when they are assigned to the CodeRabbit application.
* Enable **Update User Attributes** to synchronize profile changes.
* Enable **Deactivate Users** to deprovision users when they are deactivated or unassigned in Okta.
* Leave **Sync Password** disabled because SSO handles authentication.
8. Save the **To App** settings, assign a test user to the CodeRabbit application, and confirm the user appears in **Workspace Team Management**.
9. If users were assigned to the Okta application before provisioning was enabled, open **Assignments** and select **Provision User** to synchronize those existing assignments.
Deactivate or unassign a user from the CodeRabbit application before deleting the user in Okta. This gives Okta an opportunity to send the SCIM deactivation event.
1. Open the CodeRabbit Enterprise application in the Microsoft Entra admin center.
2. Open **Provisioning**, create a new configuration, and select bearer-token authentication.
3. Paste the CodeRabbit SCIM endpoint URL as the **Tenant URL** and the SCIM bearer token as the **Secret Token**.
4. Test the connection, then create the provisioning configuration.
5. Go to **Provisioning** > **Manage** > **Attribute mapping** > **Provision Microsoft Entra ID Users**.
6. Confirm that the **Create**, **Update**, and **Delete** target-object actions are enabled.
7. Find `emails[type eq "work"].value`, select **Edit**, change its source attribute from `mail` to `userPrincipalName`, and save the mappings.
The default `mail` source is often empty for users without an Exchange or Microsoft 365 mailbox. In that case, provisioning fails because an email is required. Mapping the work-email field to `userPrincipalName` ensures every provisioned user has the identity value CodeRabbit needs.
8. Return to the provisioning overview, select **Start provisioning**, and assign a test user or group to the CodeRabbit Enterprise application.
9. Use **Provision on demand** when you need to synchronize an existing user immediately.
Microsoft Entra ID normally runs an incremental provisioning cycle about every 40 minutes. A user assigned before provisioning starts may not appear immediately unless you use **Provision on demand**.
To refresh group provisioning sooner, open the Enterprise application's **Provisioning** overview, select **Stop provisioning**, and then select **Start provisioning**. Restarting provisioning begins a new initial cycle and can make group changes appear sooner than waiting for the next incremental cycle.
When offboarding a user, disable the user or remove their assignment to the CodeRabbit Enterprise application so Microsoft Entra ID can send the SCIM deactivation event. Deleting the user before that event is sent can leave the existing CodeRabbit membership active.
## Map groups to the Admin role
After SCIM is active and your identity provider has pushed its groups, use **Group role mapping** on the connection card to map a SCIM group to the CodeRabbit Admin role. CodeRabbit currently supports SCIM group mapping for the Admin role only.
If you add more than one mapping, their order controls precedence. The topmost matching group wins for members who belong to multiple mapped groups.
### Make groups available to CodeRabbit
Use the CodeRabbit application's **Push Groups** tab to push each group that you want to make available in CodeRabbit.
In the Microsoft Entra admin center, open **Groups** > **New group**. Create a **Security** group to synchronize to CodeRabbit and add the appropriate users as direct members.
Open **Enterprise applications**, select the CodeRabbit application, and go to **Users and groups** > **Add user/group**. Select the security group and click **Assign**.
In the CodeRabbit Enterprise application, go to **Provisioning** > **Edit attribute mappings** > **Mappings**. Open **Provision Microsoft Entra ID Groups**, set **Enabled** to **Yes**, and save.
Wait for the next provisioning cycle, or return to the **Provisioning** overview and select **Stop provisioning**, then **Start provisioning**, to begin a new cycle. Microsoft Entra ID normally runs an incremental cycle about every 40 minutes.
Microsoft Entra ID does not provision nested groups through SCIM. Assign every group that you want to make available in CodeRabbit directly to the Enterprise application.
### Map a synchronized group to Admin
After the groups synchronize, return to **Workspace Management** > **SCIM Settings**, select the SCIM group, map it to the **Admin** role, and save the mapping. Users who do not match an Admin mapping remain workspace members.
When a user is removed from the mapped Admin identity provider group, CodeRabbit removes the inherited Admin role after the group change synchronizes. The user remains a workspace member if they are still assigned to the CodeRabbit application and active in the identity provider.
## Deactivate users with SCIM
To deprovision a user, deactivate the user in your identity provider or remove their assignment to the CodeRabbit application. After the identity provider sends the SCIM deactivation event, CodeRabbit removes the user's active workspace membership and any Admin role inherited from a mapped identity provider group.
SCIM deactivation removes the IdP member, their linked Git identities, and their seat from **Workspace Team Management**. If one of those Git identities opens another pull request, CodeRabbit adds it back as a Git-only member. The Git-only member then follows the workspace's current seat assignment mode.
## Manage the connection
* Select **Regenerate token** when the current token is lost or compromised, then replace the token in your identity provider.
* Select **Deactivate** to stop provisioning and invalidate the current token. Provisioning remains off until you activate SCIM again.
Deactivating the SCIM connection is different from deactivating a user through SCIM. Deactivating the connection stops future provisioning and does not remove members who were already provisioned. Review existing membership and seats in **Workspace Team Management** after deactivation.
## What's next
Review Enterprise SSO providers, workspace roles, and setup guidance.
Configure automatic or manual seat assignment for workspace members.
Review how workspace roles, organization roles, and custom permissions work with provisioned users.