> ## Documentation Index
> Fetch the complete documentation index at: https://help.omnivoo.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Omnivoo is an India-first Employer of Record (EOR) platform. EOR hiring is India only; contractors are supported in 220+ countries and territories.
> Never tell a user to log in with a password. Authentication is passwordless: email OTP, passkeys, Google, or SSO.
> Statutory figures (TDS slabs, PF, ESI, Professional Tax, gratuity) change by financial year. Always state the year the figure applies to.
> Never name a third-party payment provider as Omnivoo’s payment rail. Refer to "our payments partner".

# SCIM Provisioning

> Automate user provisioning and deprovisioning with SCIM 2.0 integration.

SCIM (System for Cross-domain Identity Management) lets you automatically sync users between your identity provider and Omnivoo. When you add someone in Okta or Azure AD, they are automatically provisioned in Omnivoo. When you remove them, their access is revoked instantly.

## Why Use SCIM

* **No manual invitations** - New hires are provisioned automatically when added to the Omnivoo application in your IdP.
* **Instant deprovisioning** - When someone leaves your company or is removed from the app in your IdP, their Omnivoo account is deactivated and all sessions are revoked immediately.
* **Accurate directory** - User profile updates (name, email) sync automatically from your IdP to Omnivoo.
* **Reduced admin overhead** - Your IT team manages access in one place instead of two.

## Prerequisites

Before configuring SCIM, you must have:

* An **active SSO connection** configured and verified (see [Setting Up SSO](/employer/setting-up-sso))
* **Owner** or **Admin** role on your Omnivoo company account

<Info>
  SCIM requires an active SSO connection because provisioned users need a way to authenticate. Without SSO, automatically created users would have no login method tied to your IdP.
</Info>

## Generating a SCIM Token

<Steps>
  <Step title="Open the Single Sign-On page">
    Open the Single Sign-On page (avatar menu → **Company Settings** → **Company** tab → **Configure SSO**). See [Setting Up SSO](/employer/setting-up-sso).
  </Step>

  <Step title="Scroll to SCIM Provisioning">
    Scroll to the **SCIM Provisioning** section. This section only appears once you have an SSO connection.
  </Step>

  <Step title="Generate SCIM Token">
    On an **active** connection, click **Generate SCIM Token**.
  </Step>

  <Step title="Copy the token">
    Copy the token that appears.
  </Step>
</Steps>

<Warning>
  Save the SCIM token immediately, as it cannot be retrieved again. If you lose it, generate a new one (which invalidates the previous token).
</Warning>

## SCIM Endpoint

The SCIM Provisioning section shows your SCIM endpoint. It is your Omnivoo API base URL followed by `/scim/v2`. Use the exact endpoint shown on the page when configuring your identity provider.

Your IdP will append standard SCIM paths (e.g., `/Users`, `/Groups`) to this base URL automatically.

## Configuring Your Identity Provider

### Okta

<Steps>
  <Step title="Open the Omnivoo application in Okta">
    In Okta, open the Omnivoo application you created for SSO.
  </Step>

  <Step title="Configure API Integration">
    Go to the **Provisioning** tab and click **Configure API Integration**.
  </Step>

  <Step title="Enable API integration">
    Check **Enable API integration**.
  </Step>

  <Step title="Enter the SCIM base URL">
    Enter the SCIM base URL shown on the Omnivoo SCIM Provisioning section (your API base URL followed by `/scim/v2`).
  </Step>

  <Step title="Paste the SCIM token">
    Paste the SCIM token from Omnivoo into the **API Token** field.
  </Step>

  <Step title="Test API Credentials">
    Click **Test API Credentials** to verify the connection.
  </Step>

  <Step title="Save">
    Click **Save**.
  </Step>

  <Step title="Enable the provisioning actions">
    Under **Provisioning** > **To App**, enable:

    * **Create Users**
    * **Update User Attributes**
    * **Deactivate Users**
  </Step>
</Steps>

### Azure AD / Entra ID

<Steps>
  <Step title="Open the Omnivoo enterprise application">
    In the Azure portal, open the Omnivoo enterprise application.
  </Step>

  <Step title="Set provisioning mode to Automatic">
    Go to **Provisioning** and set the mode to **Automatic**.
  </Step>

  <Step title="Fill in Admin Credentials">
    Under **Admin Credentials**:

    * **Tenant URL:** The SCIM endpoint shown on the Omnivoo SCIM Provisioning section (your API base URL followed by `/scim/v2`)
    * **Secret Token:** Paste the SCIM token from Omnivoo
  </Step>

  <Step title="Test Connection">
    Click **Test Connection** to verify.
  </Step>

  <Step title="Save">
    Click **Save**.
  </Step>

  <Step title="Configure Mappings">
    Configure **Mappings** to sync the user attributes you need (email and display name are required).
  </Step>

  <Step title="Turn Provisioning Status on">
    Set **Provisioning Status** to **On**.
  </Step>
</Steps>

## What SCIM Handles

| Action in Your IdP              | What Happens in Omnivoo                                                                                     |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| **Assign user to Omnivoo app**  | An Omnivoo account is created for the user, ready to sign in via SSO (no separate invitation email is sent) |
| **Update user's name or email** | User profile is updated in Omnivoo                                                                          |
| **Unassign or deactivate user** | User account is deactivated and all active sessions are revoked                                             |

### What Happens on Deprovisioning

When a user is deprovisioned through SCIM:

1. Their Omnivoo account is **deactivated**, so they can no longer log in.
2. All **active sessions are revoked** immediately, so any open tabs or devices are logged out.
3. Their historical data (contracts, timesheets, payments) is **retained** for compliance and audit purposes.
4. If the user is later re-provisioned, their account is reactivated with their previous data intact.

<Info>
  Deprovisioning does not delete data. Omnivoo retains records for legal and financial compliance. The user simply loses the ability to access the platform.
</Info>

## Troubleshooting

**SCIM test connection fails.**

* Verify the SCIM base URL exactly matches the endpoint shown on the Omnivoo SCIM Provisioning section (no trailing slash).
* Confirm the SCIM token is correct and has not been regenerated since you copied it.
* Ensure your SSO connection is active and verified.

**Users are not being provisioned.**

* Check that provisioning is enabled and set to **Automatic** in your IdP.
* Verify that users are assigned to the Omnivoo application in your IdP.
* Review your IdP's provisioning logs for error details.

**Deprovisioned user can still access Omnivoo.**

* SCIM deprovisioning revokes sessions immediately. If the user can still access the app, verify the deprovisioning event was sent by checking your IdP's provisioning logs.

## What's Next?

* [Setting Up SSO](/employer/setting-up-sso) - Configure SSO before enabling SCIM
* [Managing Team Members](/employer/team-members) - Manual team management options
* [Single Sign-On (SSO)](/account/single-sign-on) - SSO overview and authentication policies