SCIM Provisioning

Directory sync (SCIM provisioning) lets your identity provider push Users and Groups into your organization and disable them in Keycard when you deactivate them in the directory. Without it, Single Sign-On creates a User on first login and nothing removes them when they leave.

Requires the Admin organization Role and Single Sign-On configured.

For Okta or Microsoft Entra ID, follow one of the guides below:

For any other SCIM 2.0 client:

1. Turn on directory sync

   In Keycard Console, open Settings → SSO and turn on Enable directory sync. The toggle is unavailable until SSO is enabled.

2. Copy the SCIM base URL

   Copy the SCIM Base URL shown once the toggle is on.

3. Generate a sync token

   Click Generate new token and copy the token. It is shown only once. Sync tokens are prefixed kc_scim_, do not expire, and authenticate only your organization’s SCIM endpoint.

4. Configure the SCIM client

   Add a SCIM connector to the application used for Keycard SSO. Set the base URL from step 2 and send the sync token from step 3 as a bearer token in the Authorization header. Map these attributes; others are ignored:

   Attribute	Value
   userName	The user’s login name. Used by the provider to find existing Users
   emails	The user’s email. Required
   active	The user’s enabled state
   displayName (Group)	The Group name
   members (Group)	The Group’s members

   Assign users and groups to the connector and turn provisioning on. For how Users are matched to existing accounts, see Users.

Provisioned Users appear under People with the Synced badge; provisioned Groups appear on the Groups tab.

Every change made over SCIM is recorded in the activity log with the actor “Directory Sync”. See Activity Events.

While directory sync is enabled, synced Users and Groups are owned by the external directory. Admins can view them but cannot edit what the directory manages:

• Synced Users: status cannot be changed and the User cannot be deleted in Keycard while Directory Sync is enabled. Deactivate or remove them in the identity provider instead. Roles can still be assigned or removed and the User identifier can be edited.
• Synced Groups: name and membership are read-only. The identifier can still be edited, and Roles can still be assigned.

Groups you create in Keycard keep working alongside synced Groups, and a synced User can be a member of both. Groups you create in Keycard are not sent to the identity provider.

Several sync tokens can be active at once. To rotate, click Generate new token, configure the new token in your identity provider, then delete the old one. A deleted token stops working immediately.

Turn off Enable directory sync on the Settings → SSO tab. The SCIM endpoint stops answering the provider, so its connection test fails until sync is turned back on. Nothing is deleted: Users, Groups, memberships, and Roles stay as they are, and sync tokens are kept. Synced Groups become deletable but remain read-only. Turning sync back on resumes provisioning.

• Importing Keycard Users or Groups into an identity provider is not supported.
• A synced User cannot be disabled or deleted in the Console while Directory Sync is enabled. Make those changes in the identity provider.

The email in the SSO ID token differs from the email the provider pushed over SCIM. Matching is by email under the same provider. Align the two mappings in the provider, then delete the duplicate that is not synced.

A 401 means the token is wrong or was deleted in Keycard. Generate a new token and update the provider. A 404 means directory sync is off or the base URL is wrong. Check the toggle and copy the URL again, including the /scim/v2 path.

The provider sent no email. Map the user’s email attribute to emails and make sure the user has an email set in the directory.