SCIM Provisioning

Provision, update, and deprovision your team automatically from your identity provider using SCIM 2.0 — with setup for Auth0 and Microsoft Entra ID (Azure AD), plus role and Team Group sync.

SCIM keeps StatusPal Next in sync with your identity provider (IdP). As people are added, changed, or removed in your directory, your IdP pushes those changes to StatusPal Next automatically — no manual invites, and access is revoked the moment someone leaves. It builds on Single Sign-On: SCIM matches members by email to the same identity SSO establishes.

SSO vs. SCIM. SSO controls how members sign in. SCIM controls who exists in your organization and what role or Team Group they belong to, independent of whether they ever sign in. You set up SSO first; SCIM then rides on top of it.

Before you begin

• You need an organization admin account — the Security settings are admin-only.

• SCIM requires a paid plan (the same plan gate as SSO).

• You must already have an active SSO provider configured. If you haven't, set that up first — see Single Sign-On (SSO).

• Your identity provider must support outbound SCIM 2.0 provisioning.

Not every IdP pushes groups. Role sync and Team Group sync rely on your IdP sending SCIM group updates. Microsoft Entra ID does this. Auth0's outbound SCIM sends users only — it can provision and deprovision members (who receive the default role), but it can't drive roles or Team Groups. Choose your IdP accordingly.

Connect SCIM in StatusPal

Both provider guides below start from the same StatusPal screen.

1. In the Admin Dashboard, go to Settings → Security.

2. Turn on the SSO & SCIM toggle if it isn't already, and confirm your SSO provider shows an Active badge.

3. Scroll to the SCIM provisioning section and read the warning: once connected, only members of the statuspal-next-admins group keep Admin access, and any current admin not in that group is demoted on the next sync. Set that group up correctly in your IdP first.

4. Click Connect SCIM. StatusPal generates a bearer token — copy it now. It's shown only once; if you lose it, click Rotate token for a new one.

5. Copy the SCIM endpoint URL shown just below (it ends in /scim/v2).

You'll paste the SCIM endpoint URL and bearer token into your identity provider in the next section.

The standard role groups

Create these three groups in your identity provider (exact names) to drive StatusPal roles. The section on the Security page lists them with copy buttons.

Identity provider group name	StatusPal role
statuspal-next-admins	Admin
statuspal-next-members	Member
statuspal-next-status-viewers	Status Viewer

The mapping is wholesale: everyone in a group gets that role, and anyone who holds the role but isn't in the group loses it on the next sync. Once a role is driven by SCIM, you can no longer change it by hand in StatusPal — a manual change would just be overwritten.

A member your IdP provisions who is in none of these groups gets the default role: Status Viewer if your organization has the Status Pages module enabled, or Member if it doesn't.

Team Group sync

You can also drive a Team Group's membership from an IdP group:

1. In Settings → Members → Groups, open (or create) a Team Group.

2. In the SCIM Group Name field, enter the exact name of the matching group in your identity provider (for example Product-Team).

3. Save. From now on that Team Group's membership is set by the matching IdP group and can't be edited by hand.

The three role group names above are reserved: a push named statuspal-next-admins, statuspal-next-members, or statuspal-next-status-viewers always drives roles, so StatusPal won't let you use one as a Team Group's SCIM Group Name. Give the IdP group a distinct name for Team Group sync.

If you set a SCIM Group Name but no push has matched it yet, StatusPal shows a note on the group — a quick way to catch a typo, which otherwise fails silently.

Auth0

Auth0 provisions and deprovisions users through Event Streams and an Auth0 Action that runs Auth0's Outbound SCIM template code. It reacts to user changes in your Auth0 directory (created, updated, deleted) and sends the matching SCIM request to StatusPal.

1. In the Auth0 Dashboard, go to Event Streams, create a new stream, and choose Auth0 Actions as the destination. Give it a name such as StatusPal Next SCIM.

2. Under Select Events, tick user.created, user.updated, and user.deleted. Leave the group events unchecked. Auth0's outbound SCIM syncs user profiles only.

3. Auth0 creates a linked Action. In the Action editor, open the Secrets panel (the key icon) and add two secrets: SCIM_BASE_URL set to the SCIM endpoint URL you copied from StatusPal (it ends in /scim/v2), and SCIM_BEARER_TOKEN set to the bearer token.

4. Open Auth0's outbound SCIM Action template (code.js), copy the whole file, and paste it into the Action editor. Then save and deploy the Action. For background, see Auth0's guide, Synchronize user changes with Outbound SCIM using Event Streams.

5. Because Event Streams only react to new events, run a one-time bulk sync of your existing Auth0 users into StatusPal before enabling the stream, so current members are provisioned too.

6. Enable the stream.

New Auth0 users now appear in Settings → Members as pending members with the default role; deleting a user in Auth0 removes them from StatusPal.

Auth0 does not sync roles or Team Groups. Its outbound SCIM sends only user events, so the standard role groups and Team Group sync above don't apply — members keep the default role and you manage roles and Team Groups manually in StatusPal. For full role and group sync, use an identity provider that pushes SCIM groups, such as Microsoft Entra ID below.

Microsoft Entra ID (Azure AD)

Entra ID provisions users and groups, so it drives the whole feature: provisioning, role sync, Team Group sync, and deprovisioning.

1. In the Azure Portal, open Microsoft Entra ID → Enterprise applications. Use the same application you created for SSO, or add a new one with New application → Create your own application → Integrate any other application you don't find in the gallery (Non-gallery).

2. In the app's left menu, select Provisioning, then set Provisioning Mode to Automatic.

3. Under Admin Credentials:

   • Tenant URL — paste the StatusPal SCIM endpoint URL (ends in /scim/v2).

   • Secret Token — paste the StatusPal bearer token.

4. Click Test Connection. Entra queries your endpoint for a non-existent user and expects an empty result — a success confirms the URL and token are right.

5. Save.

6. Create the groups that drive roles and Team Groups, and assign them (and your users) to the application:

   • For roles, create Entra groups named exactly statuspal-next-admins, statuspal-next-members, and statuspal-next-status-viewers, and put the right people in each.

   • For a Team Group, create an Entra group whose name matches the SCIM Group Name you set on the StatusPal Team Group (for example Product-Team).

   • Under the app's Users and groups, add each of these groups (Entra only provisions users and groups that are assigned).

7. Select Start provisioning.

Entra syncs on a schedule — the first cycle runs shortly after you start, and later cycles run about every 40 minutes. To test a single user immediately, use Provision on-demand on the Provisioning page. Watch Provisioning logs to confirm each user and group was sent.

What SCIM manages, and what locks

Once SCIM drives a role or a Team Group, StatusPal shows it and prevents manual edits:

• Members whose role or group membership is set by SCIM show a Managed via SCIM badge in the Members list.

• The matching control — the role menu, or a SCIM-linked group's membership — is disabled, with a tooltip explaining why.

Audit logs

Every SCIM-driven change is recorded in Settings → Audit logs, so you can see after the fact why someone's role or group changed — including catching an unwanted demotion, or a mistyped group name. Filter by No status page to see SCIM events. Three kinds of entries appear:

• A role changed via SCIM.

• A member added to or removed from a Team Group via SCIM.

• A group your IdP pushed that matched no role or Team Group (so a typo is visible instead of silently doing nothing).

Managing the connection

From the SCIM provisioning section on the Security page you can:

• Rotate token — generate a new bearer token; the previous one stops working immediately, so update it in your identity provider.

• Disconnect — stop SCIM. Disconnecting removes nobody; it simply hands control of the affected roles and Team Groups back to you, editable by hand again, starting from whoever currently holds them.