All Products
Search

This Product

    Identity as a Service:IDaaS synchronization to applications - SCIM

    Document Center

    Identity as a Service:IDaaS synchronization to applications - SCIM

    Last Updated:Jun 21, 2026

    This topic describes how to use the System for Cross-domain Identity Management (SCIM) protocol for account provisioning in IDaaS EIAM. The standard SCIM interface lets you efficiently synchronize user and organization data to third-party applications, simplifying identity management and improving operational efficiency. This topic covers the configuration, API calls, and important considerations to help you quickly integrate identity information across systems.

    Usage notes

    • The SCIM specification does not support organization synchronization. IDaaS EIAM does not support synchronizing organizations to downstream applications.

    • IDaaS EIAM supports both group and account synchronization. However, whether the data can be synchronized to a downstream application depends on the application's capabilities. Currently, Resource Access Management (RAM) supports only account synchronization, while Cloud SSO supports both account and group synchronization.

    • When you provision accounts to Resource Access Management (RAM) or Cloud SSO by using SCIM, account field values are converted to lowercase before synchronization. This is because RAM is case-insensitive, and this step prevents potential conflicts.

    Configuration

    On the Application Management page, go to the Account Sync tab and select SCIM as the synchronization method to provision accounts to SCIM-compatible applications.

    To configure SCIM provisioning, you must configure both IDaaS EIAM and the target application. For example, to provision accounts to Resource Access Management (RAM) or Cloud SSO, consult their respective documentation in addition to this topic. If you want to provision accounts to other applications, find their SCIM enablement documentation and use it in conjunction with this topic.

    Application

    Documentation

    Cloud SSO

    Synchronize accounts to Cloud SSO by using SCIM

    Configuring SCIM provisioning is similar to configuring event-based callbacks. First, specify the synchronization scope, and then configure the SCIM client parameters.

    The following table describes the parameters.

    Parameter

    Description

    Outbound IP

    Add the IDaaS EIAM outbound IP addresses to the allowlist in your security settings to ensure that IDaaS EIAM requests can reach the destination application.

    SCIM Base URL

    Enter the SCIM endpoint URL of the client application that receives provisioning requests.

    For example, the SCIM Base URL for Resource Access Management (RAM) is fixed: SCIM Base URL fixed address.

    Grant Type

    Different SCIM clients may require different API authentication methods. IDaaS EIAM supports OAuth 2.0 Client Credentials and Bearer Token Mode. Select the one required by your client application.

    For example, Resource Access Management (RAM) supports OAuth 2.0 Client Credentials to authenticate SCIM requests.

    After you select OAuth 2.0 Client Credentials, configure the following parameters: token endpoint (for example, https://www.example.com/oauth/token), authentication mode (select client_secret_basic or client_secret_post), Client ID (required), and Client Secret (required).

    Operation

    Subscribe to specific change events to receive immediate push notifications.

    When a corresponding change occurs in IDaaS EIAM, synchronization is automatically triggered to update the application in real time.

    In the Operation section, select the SCIM operation types you want to send: Create Account (CREATE /Users), Update Account (UPDATE /Users), Delete Account (DELETE /Users), Create Group (CREATE /Groups), Update Group (UPDATE /Groups), and Delete Group (DELETE /Groups).

    Note

    The selected operations apply to both incremental data synchronization and full data synchronization.

    Full Scope

    When you perform a full data synchronization (Push Now), only the data types selected in this section that are also within the application's synchronization scope are pushed to the downstream application. For example, you can choose to push only account data.

    The Full Scope section provides two checkboxes: Account and Group. Select the data types you need to push.

    Note

    This setting affects only full data synchronization, not incremental data synchronization.

    Field Mapping

    View and edit the attribute mappings for SCIM provisioning.

    On the Field Mapping tab, you can configure the mapping between SCIM server attributes and local attributes. Three default mappings are provided. The user external ID (appUser.externalId) is required and is mapped to userId. The user name (appUser.userName) is mapped to account name. The display name (appUser.displayName) is mapped by using the expression Coalesce(user.displayName, user.username). You can add or remove mappings.

    After saving the configuration, use the Test Connection feature to verify your settings.

    If necessary, an administrator can use the Push Now feature to push all accounts within the synchronization scope to the application at once.

    SCIM support

    Platform

    SCIM support

    Retrieve existing users

    Modify existing users

    Link existing users

    Resource Access Management (RAM)

    Yes

    Yes

    No

    No

    Cloud SSO

    Yes

    No

    No

    Yes (implicitly supported by Cloud SSO's name-based overwrite logic)

    Huawei Cloud IAM

    No

    -

    -

    -

    Huawei Cloud IAM Identity Center

    Yes

    Yes

    Yes

    Yes

    Tencent Cloud CAM

    No

    -

    -

    -

    Tencent Cloud Organization Management

    Yes

    Yes

    Yes

    Yes (Usernames cannot be changed.)

    Volcano Engine IAM

    No

    -

    -

    -

    Volcano Engine Cloud Identity Center

    Yes

    No

    No

    No

    AWS IAM

    No

    -

    -

    -

    AWS IAM Identity Center

    Yes

    Yes

    Yes

    Yes

    References