> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning

> Prepare directory ownership, user and group mappings, and lifecycle verification before relying on automated provisioning.

SCIM provisioning synchronizes directory identity data with an application. Plan creation, updates, suspension, reactivation, and group changes separately from the SSO sign-in test.

<Note>
  Threetone has identity-event processing and directory-related membership fields, but no released self-service SCIM setup or verified end-to-end provisioning rollout. There is no documented Threetone tenant-URL and token wizard to follow.
</Note>

## Prepare the directory plan

You need the directory administrator, workspace owner, a small test cohort, and an agreed authority for identities and group membership. [WorkOS directory provisioning](https://workos.com/docs/authkit/directory-provisioning) requires organization-specific setup; provider capability alone does not activate it in Threetone.

<Steps>
  <Step title="Define authoritative identities" id="scim-identities">
    Record stable user identifiers, primary emails, group IDs, and the intended workspace. Decide how contractors, duplicate emails, renamed users, and existing manual memberships should be handled.
  </Step>

  <Step title="Specify mappings and credentials" id="scim-mappings">
    Document the intended user and group mappings. Obtain endpoint and credential details only through the supported setup process. Store provisioning credentials securely and identify their rotation owner.
  </Step>

  <Step title="Verify the complete lifecycle" id="scim-lifecycle">
    Once provisioning is supported, test creation, attribute updates, group addition and removal, suspension, and reactivation. Inspect workspace membership, resource access, and existing-session behavior after each change. Record delayed or failed synchronization separately.
  </Step>
</Steps>

Treat deactivation, account deletion, and directory disconnection as distinct actions. WorkOS documents different behavior for deprovisioning a user and deleting a directory; neither should be assumed to erase application data. See [retention limits](/agents-platform/monitor/privacy/retention).

The current [user-group view](/overview/administration/workspaces/user-groups) can display directory metadata. A Directory badge is not evidence that all lifecycle checks passed.

<AccordionGroup>
  <Accordion title="Does disabling SSO remove a workspace member?" id="scim-faq-sso">Do not assume it. Authentication, membership status, resource grants, and active sessions need separate verification.</Accordion>
  <Accordion title="Should I edit a directory-managed group manually?" id="scim-faq-authority">Follow the group's management source. The dashboard restricts manual controls for directory-managed or frozen groups.</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.