Automatic provisioning with SCIM 2.0

If your identity provider or HR platform speaks SCIM 2.0 — Okta, Microsoft Entra, and Rippling all do — it can manage your roster here directly. New hires get an account, a seat, and an enrollment the day they start, and departures are deprovisioned the day they leave, with no one touching a spreadsheet in between.

Setup. An organization admin opens Settings → Organization and finds Automatic provisioning. Generating a token there shows two things: the SCIM base URL and a bearer token. Copy the token immediately — it's shown once and stored hashed, so it can't be retrieved later, only revoked and regenerated. Those two values are all any SCIM-speaking platform asks for.

How provisioning behaves. Accounts your platform creates arrive verified (your system vouched for the person), enrolled in the course, and occupying a seat — the same treatment as every other way of joining. If your organization's seats are full, the creation is refused with a clear error, and your platform will retry on its own once you've added seats. Each token is scoped to exactly one organization, and requests are matched by work email.

Deprovisioning keeps the training record. When your platform deactivates or deletes someone, we remove their seat and organization membership — and deliberately nothing else. Their account, their course progress, and any Certificate of Completion stay on record, because training documentation is supposed to outlive employment; it's precisely what an auditor will ask you to show about a former employee. If the person is later reactivated, they rejoin your organization with their history intact, seats permitting.

The technical surface, for whoever configures your platform: the base URL serves the standard SCIM 2.0 endpoints — ServiceProviderConfig, ResourceTypes, Schemas, and Users with create, read, filter (userName eq), update, patch, and delete — authenticated by the bearer token on every request. userName is the person's email address.

Platform walkthroughs: Okta, Microsoft Entra, Rippling. For platforms without SCIM, including Gusto, see the CSV route.