> ## Documentation Index > Fetch the complete documentation index at: https://hc.saas-manager.biz.nuro.jp/llms.txt > Use this file to discover all available pages before exploring further. # How to Configure SCIM > You need to enable SAML before using SCIM. ### How to configure SCIM You need to enable SAML before using SCIM. Refer to the [SAML configuration guide](/en/it-management/settings/sni7chcawy-saml) and enable SAML first. #### Obtain your organization's SCIM credentials Go to **Settings > Security** and open the **SCIM** section to get the tenant URL and secret token required for your IdP. If no secret token exists, click the generate button. Each organization can only have one SCIM secret token at a time. Generating a new token immediately invalidates the previous one. Screenshot #### Configure SCIM invitation emails When provisioning users via SCIM, you can choose whether to send an invitation email to newly added users. #### Prerequisites * SAML must be configured and enabled. * The invitation email toggle appears only after a secret token has been generated. * This setting applies to users created after SCIM is configured. Invitation emails are not re-sent to already-provisioned users. #### Configuration steps 1. Go to **Settings > Security > SCIM > Secret token** and click **Regenerate Secret Token**.\ Note: Regenerating the token invalidates the previous token. If you are already using the token in your IdP, update the token on the IdP side as well. 2. Once the token is generated, an **Invitation email** toggle appears below it.\ **Do not send:** The user is created without any notification email.\ **Send:** An invitation email to the service is automatically sent when the user is created. 3. Use the **Invitation email** toggle to choose your preference. Screenshot ### Enable SCIM in your IdP Open the application you created in your IdP for SAML. #### Entra ID Entra ID guide 1. Select **Provisioning** from the side menu and click the **Get Started** button. Screenshot 2. Select **Automatic** mode. Screenshot 3. Enter the tenant URL and secret token obtained from the service.\ For **Select authentication method**, choose **Bearer authentication**.\ Click **Save** in the upper left to save the settings.\ (When running Test Connection, SAML must be enabled in the service.) Screenshot Screenshot You do not need to store the secret token elsewhere.\ You can regenerate it whenever you need a new one. 4. Open **Mappings** and disable group provisioning. Screenshot 5. Select **Provision Entra ID Users** and configure the **Microsoft Entra ID Attribute** as shown in the image below. Screenshot 6. Configure the attributes as shown in the image below.\ Confirm that the **Matching precedence** for `userPrincipalName` is set to `1`. Screenshot 7. Click **Save** in the upper left again to complete the setup.\ Users assigned to the application are automatically provisioned to the service. #### Okta The service now supports the Okta Integration Network (OIN), which makes configuration easier. See the setup guide here: [SAML/SCIM configuration with Okta Integration Network](/en/it-management/settings/wllb3ml0pq-oin) #### Supported features | Feature | Description | | ------------------------------------------- | --------------------------------------------------------------------------------- | | Create new users | When a user is created in Okta, a corresponding user is created in the service. | | Update user profiles | User information updated in Okta is reflected in the service. | | Deactivate (and reactivate) or delete users | Deactivations, reactivations, and deletions in Okta are reflected in the service. | #### Prerequisites * You need to enable SAML before using SCIM. Refer to the [SAML configuration guide](/en/it-management/settings/sni7chcawy-saml) and enable SAML in advance. #### Configuration steps 1. Open your application from **Applications**, go to the **Sign on** tab, and change **Application username format** to **Email**. Screenshot 2. On the **General** tab, select **Enable SCIM provisioning** under **Provisioning**. Screenshot 3. Open the **Provisioning** tab and enter the following information. | Field | Value | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | `SCIM connector base URL` | Enter the **Tenant URL** obtained from the service | | `Unique identifier field for users` | Enter **userName** | | `Supported provisioning actions` | Check the following values:
- **Import New Users and Profile Updates**
- **Push New Users**
- **Push Profile Updates** | | `Authentication Mode` | Select **HTTP Header** | | `Authorization` | Enter the **Secret Token** obtained from the service | Screenshot 4. Click **Test Connector Configuration** and confirm that everything succeeds except **Push groups** and **Import groups**. 5. After a successful test, click **Close** and save. Screenshot 6. In the **To App** section on the next screen, enable the following:\\ * Create Users\\ * Update User Attributes\\ * Deactivate Users Screenshot 7. Scroll further down on the same screen to the **Attribute Mappings** section.\ Match the configuration to the screenshot. Screenshot 8. This completes the setup.\ Users assigned to the application are automatically provisioned to the service. #### Known issues and troubleshooting The service does not yet support provisioning from the application to Okta. Leave the **To Okta** settings at their default (disabled). #### OneLogin OneLogin guide 1. Open the **Configuration** page and enter the following values. | Field | Value | | ------------------- | -------------------------------------------------- | | `SCIM Base URL` | Enter the `Tenant URL` obtained from the service | | `SCIM Bearer Token` | Enter the `Secret Token` obtained from the service | 2. Click **Enable** to activate. If no errors appear, click **Save**. Screenshot 3. Open the **Provisioning** page.\ Enable **Enable provisioning**.\ Optionally, change what happens when a user is deleted in OneLogin. 4. Save the settings. Screenshot 5. This completes the setup.\ Users assigned to the application are automatically provisioned to the service.