Provision people with SCIM

SCIM lets your identity provider, such as Microsoft Entra ID or Okta, manage who is in your DMARCLoop organisation. When someone is assigned to the application there, they get an account and join; when they’re unassigned or disabled, they’re removed and signed out. It comes with single sign-on, which is an add-on: if your plan doesn’t include it, see plans.

Owners and admins set it up under Single sign-on in the left sidebar, in the User provisioning (SCIM) section.

Before you start

SCIM only provisions email addresses on your verified domains, the ones you proved for single sign-on. Verify at least one first; see verify your domains. Addresses on a subdomain, such as eu.example.com under example.com, are covered too.

Create a token

1. Choose Create SCIM token.
2. Copy the token straight away. It is shown once and can’t be shown again; only a fingerprint of it is stored.
3. Copy the SCIM base URL. It is your app address followed by /scim/v2.

A token lasts a year. Each one is listed with the start of its value, when it was created, when it expires and when it was Last used.

Connect your identity provider

Microsoft Entra ID

In the enterprise application for DMARCLoop, open Provisioning, set the mode to automatic, and enter the SCIM base URL as the Tenant URL and the token as the Secret Token. Test the connection, then start provisioning. Entra ID matches people on their user principal name, so it should be their email address.

Okta

In the app integration, turn on SCIM provisioning. Enter the SCIM base URL as the SCIM connector base URL, choose userName as the unique identifier, and HTTP Header as the authentication mode with the token as the bearer token. Then turn on creating users, updating user attributes and deactivating users.

Other identity providers work the same way if they speak SCIM 2.0: a base URL and a bearer token.

What provisioning does

• Adding someone creates their DMARCLoop account, with no email to confirm, and they join as Read-only. If they already have an account, it is used: nobody gets a second one. Someone who was already in your organisation keeps their role. Change roles under People; see invite people and roles.
• Updating someone changes their name and email address. A new address must also be on a verified domain.
• Disabling or removing someone takes them out of your organisation straight away. If their email address is on one of your verified domains, your organisation owns that identity, so their DMARCLoop account is turned off too. They’re signed out everywhere and can’t sign in again by any method, including password, passkey and single sign-on, until your identity provider turns them back on. The account isn’t deleted. Someone whose address isn’t on your verified domains, such as an outside contractor, just leaves your organisation and keeps their account. Your only owner can’t be removed this way; make someone else an owner first.
• Turning someone back on, or adding them again after removing them, turns their account back on and they rejoin as Read-only. A turn-off that didn’t come from your identity provider isn’t lifted this way.
• Your plan’s user limit applies: once it is reached, your identity provider is told the organisation is full, and nobody else is added until you upgrade or remove someone.

When someone your identity provider added signs in with Use SSO, it’s the same account and the same membership. Once your identity provider has synced, single sign-on doesn’t add people by itself: your identity provider decides who is in. Until then, people still join the first time they sign in with SSO.

SCIM manages people only, not groups. Roles in DMARCLoop stay with your owners and admins.

Replace or revoke a token

You can have two tokens at once, so you can move to a new one without a gap:

1. Choose Create SCIM token to make a second token.
2. Paste it into your identity provider and check that provisioning still works. Its Last used time updates.
3. Choose Revoke next to the old token.

With two tokens, Create SCIM token is unavailable until you revoke one. Revoking your only token stops provisioning: nobody is removed, and nobody new is added until you create a token again.

Someone whose account was turned off sees, when they try to sign in, that their organisation has turned it off in its identity provider.

Every token change and every person added, changed or removed is recorded in the audit log.

MSP clients

SCIM belongs to each organisation. A client organisation creates its own token and connects its own identity provider. Your MSP staff who reach a client through your partner account aren’t affected by the client’s directory.