All Products
Search

This Product

    Identity as a Service:SCIM provisioning from IDaaS to CloudSSO

    Document Center

    Identity as a Service:SCIM provisioning from IDaaS to CloudSSO

    Last Updated:Jun 21, 2026

    This topic describes how to provision accounts and groups from IDaaS to CloudSSO using the System for Cross-domain Identity Management (SCIM) protocol to automate identity management.

    Step 1: Enable SCIM provisioning in CloudSSO

    1. Log on to the CloudSSO console with your Alibaba Cloud account.

    2. In the left-side navigation pane, click Settings.

    3. On the User Settings tab, turn on the switch under SCIM User Provisioning Configuration to enable SCIM provisioning. Copy the SCIM endpoint.

    4. Click Generate New SCIM Credential.

      The SCIM credential is displayed only once. Copy and store it securely.

    Step 2: Configure SCIM provisioning in IDaaS

    1. Log on to the IDaaS console. In the left-side navigation pane, click EIAM. In the instance list, find the target instance and click Console in the Actions column to open the instance console.

    2. In the left-side navigation pane of the instance console, choose Application Management > Applications to open the Applications page. Then, click Add Application to go to the Marketplace, select Alibaba Cloud - CloudSSO, and then click Add Application.

    3. In the Add Application panel, enter an Application Name and click Add. After the application is added, its details page opens.

    4. On the application details page, switch to the Provisioning tab, click Configure Provisioning Scope > Configuration, select the Organization and Group to synchronize, and then click Save.

    5. Turn on the Provision IDaaS Accounts to Application switch. In the confirmation dialog box, click Enable.

    6. In the Basic Configurations section, paste the SCIM endpoint into the SCIM endpoint field. Paste the SCIM credential into the Bearer Token field.

      In the Operations section, select the operations that you want to enable, such as account creation (CREATE /Users), account updates (UPDATE /Users), account deletion (DELETE /Users), group creation (CREATE /Groups), group updates (UPDATE /Groups), and group deletion (DELETE /Groups). In the Full Push Scope section, select Account and Group as needed. This setting determines which data is pushed when you click Push Now.

    7. Configure the Operation, Full Scope, and Field Mapping.

      1. Operation: Defines which change events trigger real-time provisioning. When a subscribed change occurs for a user within the provisioning scope, the change is automatically provisioned to the application.

      2. Full Scope: Specifies which data is provisioned when you click Push Now. You must select at least one item to use the Push Now feature.

      3. Field Mapping: View and customize the field mappings for SCIM provisioning.

    8. Test the connection.

      After you configure the settings, click Save, and then click Test Connectivity to verify them. If needed, you can use the Push Now feature to provision all accounts within the defined scope to CloudSSO at once.

    Step 3: Perform provisioning

    After you click Push Now, the accounts and groups within the provisioning scope are provisioned to CloudSSO. A success message appears when the task is complete. You can view the logs by navigating to Log > Provisioning > Tasks.