SCIM provisioning
Plugboard implements SCIM 2.0 (RFC 7643 and 7644) so your identity provider can create, update and deactivate technician accounts automatically.
Why it matters more than it sounds
Section titled “Why it matters more than it sounds”Creating accounts automatically is convenient. Deprovisioning is the reason this feature exists.
Without it, a leaver keeps working access until somebody remembers to deactivate them by hand, and even then their refresh tokens stay valid for up to thirty days. With it, Entra or Google pushes the change the moment HR disables the account, and every refresh token is revoked in the same transaction. Access ends immediately.
An auditor asks about this under SOC 2 CC6.2 and CC6.3, or ISO 27001 A.5.16 and A.5.18. They want to know whether the system enforces it or whether you have a process on paper.
Setting it up
Section titled “Setting it up”You need the SCIM base URL and a bearer token from Plugboard, then you paste both into your identity provider.
Microsoft Entra ID
Section titled “Microsoft Entra ID”- Entra admin centre, Enterprise applications, and open (or create) the application you use for Plugboard.
- Provisioning, Get started, and set the mode to Automatic.
- Under Admin Credentials:
- Tenant URL: the SCIM base URL from Plugboard.
- Secret Token: the bearer token from Plugboard.
- Test Connection, then Save.
- Under Mappings, keep the default user mapping. The attributes Plugboard reads are below.
- Set the scope to the group of staff who should have accounts, then turn provisioning On.
Entra syncs on its own schedule, roughly every forty minutes. Use Provision on demand to test a single user immediately rather than waiting.
Google Workspace
Section titled “Google Workspace”- Google Admin console, Apps, Web and mobile apps.
- Open your Plugboard SAML or OIDC application, then Auto-provisioning.
- Enter the SCIM endpoint and token.
- Map the attributes, then turn it on for the organisational unit that should have accounts.
Anything else
Section titled “Anything else”Any SCIM 2.0 client works. The endpoints are the standard ones under the SCIM base URL, authenticated with the bearer token.
Attributes used
Section titled “Attributes used”| SCIM attribute | Becomes |
|---|---|
userName |
The sign-in identifier |
name.givenName, name.familyName |
The display name |
displayName |
The display name, if the parts are absent |
emails[primary].value |
The email address |
active |
Whether the account can sign in |
externalId |
Kept, so the provider’s own identifier links the records |
PATCH operations are supported, which is how most providers signal a
deactivation: a patch setting active to false.
What happens on each operation
Section titled “What happens on each operation”| Provider does | Plugboard does |
|---|---|
| Creates a user | Creates an account. Roles are not assigned; see below |
| Updates a user | Updates the name and email |
Sets active false |
Deactivates the account and revokes every refresh token in the same transaction |
Sets active true |
Reactivates the account |
| Deletes a user | Deactivates rather than deleting, so history keeps its attribution |
Roles are not provisioned
Section titled “Roles are not provisioned”SCIM creates the account. It does not decide what the account can do.
Permissions in a service desk are a judgement about trust, and mapping them from a directory group means a change in the directory silently changes what somebody can wipe. Assign roles in Plugboard.
The practical consequence: a newly provisioned account can sign in and see very little until you give it a role. That is the safe failure mode.
Plugboard’s SCIM discovery therefore advertises the User resource only, not
Group. In Microsoft Entra, leave the provisioning job’s group-mapping step
unconfigured. You can still scope the job to a directory group to choose who
receives an account; that setting does not provision the group itself or assign
Plugboard roles.
SCIM and SSO together
Section titled “SCIM and SSO together”They solve different halves.
- SSO authenticates: is this the right person.
- SCIM provisions: should this person have an account at all, right now.
Running SSO without SCIM works, as long as somebody deactivates leavers. Running both takes that job off a person.
Checking it works
Section titled “Checking it works”One test, once:
- Provision a test user from your identity provider.
- Confirm the account appears under Admin, Users.
- Give it a role and sign in as it.
- Disable the user at the identity provider.
- Confirm the account shows as inactive within your provider’s sync window, and that the session is dead rather than continuing until expiry.
Step five is the one to check. It is also the one most often skipped.
Licensing
Section titled “Licensing”SCIM is included in the Plugboard plan, and in the Advanced and Enterprise tiers for licences on the earlier tiers. See plans.