Skip to main content
SCIM (System for Cross-domain Identity Management) 2.0 lets you manage Paxos Dashboard access directly from your Identity Provider (IdP). Once set up, user imports and deprovisioning stay in sync with your IdP, so you don’t invite or remove users by hand.
SCIM is available for Organizations using SSO. To enable it for your Organization, contact Support.

​
How It Works

  • Sign-in and SCIM are separate. SSO (your SAML/OIDC app) signs users in; SCIM (a separate app) keeps the Dashboard in sync. Adding SCIM doesn’t change how users sign in.
  • Users are created on first sign-in (JIT). A Dashboard account is created the first time a user signs in with SSO — not when you assign them in your IdP. Assigning a user alone doesn’t create their account; they must sign in once.
  • Users are matched by email between your IdP and the Dashboard.
  • Group membership grants access only through a Role mapping.
Once connected, SCIM keeps the Dashboard in sync with your IdP by:
  • Matching existing Dashboard users to your IdP by email, so the two stay in sync (your IdP may label this “importing users”).
  • Syncing names (optional). The Dashboard uses the SCIM displayName if your IdP sends it, otherwise it combines givenName and familyName; if neither is provided, the existing name is left unchanged.
  • Deprovisioning — removing Dashboard access when you deactivate or unassign a user.
  • Pushing groups so their members receive mapped Roles.

​
Set Up in the Dashboard

These steps happen in the Paxos Dashboard and are the same for any Identity Provider. Once done, follow your Identity Provider’s integration guide to connect it. Before you start, SSO must already be working for your Organization.

​
➊ Create an API credential

Go to Admin > API Management and create a credential with the scim:read and scim:write scopes. Under Advanced Settings:
  • Set the Grant Types to include Authorization Code and Refresh Token.
  • Enter your IdP’s OAuth redirect URI (its callback URL). This is required, and it must match exactly — otherwise authorization later fails with a redirect_uri does not match error. See your Identity Provider guide for where to find it.
Copy the Client ID and Client Secret — your IdP needs them.

​
➋ Authorize the credential

When your IdP initiates the OAuth connection, you’re redirected to the Paxos Dashboard to authorize the credential for the scim:read and scim:write scopes. Sign in and approve — your IdP stores the resulting refresh token and uses it to authenticate every SCIM call from here on, refreshing automatically. Your IdP connects to these Paxos endpoints:

​
Identity Provider Guides

Follow the guide for your Identity Provider to complete the connection:
Guides for additional Identity Providers are coming. Using a different SCIM 2.0 IdP (for example, Microsoft Entra ID)? The Dashboard steps above are the same — only the IdP-side setting names differ. Contact Support for help.

​
Removing and Limiting Access

Deprovisioning deletes the account. Deactivating a user in your IdP, or unassigning the app, deletes their Dashboard account and globally signs them out — it is not a temporary pause. A user who returns later is re-created from scratch and re-matched by email; their prior account and history are not restored.
Two actions block a user’s access, with different consequences:
  • Deprovision from your IdP — destructive. Deactivating or unassigning the user in your IdP deletes the Dashboard account and globally signs them out. This can’t be undone — a returning user is re-created fresh.
  • Disable in the Dashboard — reversible. Use the Edit Status dropdown at Admin > Team Management > Users to disable a user. This is a second layer for a temporary block: it keeps their account, history, and Roles so you can re-enable them at any time. Disabling here does not remove the user from your IdP app or deassign them in your IdP.
Other behaviors:
  • What triggers deprovisioning depends on your IdP. Only an explicit deprovision — for example, deactivating or unassigning the user — deletes the account. Some IdP states, such as a temporary suspend, send no SCIM signal and have no effect. See your integration guide for the exact triggers.
  • Removing a member from an IdP group removes that user from the Dashboard Role(s) the group is mapped to. Un-pushing a whole group from your IdP does not delete it in the Dashboard (it anchors the Role mapping) — remove members or update the mapping instead.

​
Verify and Roll Out

Test in a non-production environment first:
  1. Sign a test user in via SSO — confirm they appear Active in Admin > Team Management > Users with the expected Roles.
  2. Import from your IdP — confirm the user is matched by email.
  3. Deprovision the user — confirm their Dashboard access is removed.
Once verified, roll out to your production users.
Questions? Contact Support.