Skip to main content
SCIM provisioning synchronizes directory identity data with an application. Plan creation, updates, suspension, reactivation, and group changes separately from the SSO sign-in test.
Threetone has identity-event processing and directory-related membership fields, but no released self-service SCIM setup or verified end-to-end provisioning rollout. There is no documented Threetone tenant-URL and token wizard to follow.

​
Prepare the directory plan

You need the directory administrator, workspace owner, a small test cohort, and an agreed authority for identities and group membership. WorkOS directory provisioning requires organization-specific setup; provider capability alone does not activate it in Threetone.
1

Define authoritative identities

Record stable user identifiers, primary emails, group IDs, and the intended workspace. Decide how contractors, duplicate emails, renamed users, and existing manual memberships should be handled.
2

Specify mappings and credentials

Document the intended user and group mappings. Obtain endpoint and credential details only through the supported setup process. Store provisioning credentials securely and identify their rotation owner.
3

Verify the complete lifecycle

Once provisioning is supported, test creation, attribute updates, group addition and removal, suspension, and reactivation. Inspect workspace membership, resource access, and existing-session behavior after each change. Record delayed or failed synchronization separately.
Treat deactivation, account deletion, and directory disconnection as distinct actions. WorkOS documents different behavior for deprovisioning a user and deleting a directory; neither should be assumed to erase application data. See retention limits. The current user-group view can display directory metadata. A Directory badge is not evidence that all lifecycle checks passed.
Do not assume it. Authentication, membership status, resource grants, and active sessions need separate verification.
Follow the group’s management source. The dashboard restricts manual controls for directory-managed or frozen groups.