All Products
Search

This Product

    Identity as a Service:IDaaS synchronization to applications - SCIM

    Document Center

    Identity as a Service:IDaaS synchronization to applications - SCIM

    Last Updated:Jul 17, 2026

    IDaaS EIAM uses the SCIM (System for Cross-domain Identity Management) protocol to synchronize user and group data to third-party applications. This topic covers configuration steps, API authentication, and important considerations for cross-system identity integration.

    Usage notes

    • The SCIM specification does not support organization synchronization. IDaaS EIAM does not support synchronizing organizations to downstream applications.

    • IDaaS EIAM supports both group and account synchronization. However, whether the data can be synchronized to a downstream application depends on the application's capabilities. Currently, Resource Access Management (RAM) supports only account synchronization, while Cloud SSO supports both account and group synchronization.

    • When you provision accounts to Resource Access Management (RAM) or Cloud SSO by using SCIM, account field values are converted to lowercase before synchronization. This is because RAM is case-insensitive, and this step prevents potential conflicts.

    Configuration

    On the Application Management page, go to the Account Sync tab and select SCIM as the synchronization method to provision accounts to SCIM-compatible applications.

    SCIM provisioning requires configuration on both IDaaS EIAM and the target application. To provision accounts to RAM or Cloud SSO, refer to their respective documentation alongside this topic. For other applications, consult the application's SCIM enablement documentation.

    Application

    Documentation

    Cloud SSO

    Synchronize accounts to Cloud SSO by using SCIM

    Configuring SCIM provisioning is similar to configuring event-based callbacks. First, specify the synchronization scope, and then configure the SCIM client parameters.

    The following table describes the parameters.

    Parameter

    Description

    Outbound IP

    Add the IDaaS EIAM outbound IP addresses to the allowlist in your security settings to ensure that IDaaS EIAM requests can reach the destination application.

    SCIM Base URL

    Enter the SCIM endpoint URL of the client application that receives provisioning requests.

    For example, the SCIM Base URL for Resource Access Management (RAM) is fixed: SCIM Base URL fixed address.

    Grant Type

    IDaaS EIAM supports OAuth 2.0 Client Credentials and Bearer Token Mode. Select the authentication method required by your client application.

    For example, Resource Access Management (RAM) supports OAuth 2.0 Client Credentials to authenticate SCIM requests.

    After you select OAuth 2.0 Client Credentials, configure the following parameters: token endpoint (for example, https://www.example.com/oauth/token), authentication mode (select client_secret_basic or client_secret_post), Client ID (required), and Client Secret (required).

    Operation

    Subscribe to specific change events to receive immediate push notifications.

    When a corresponding change occurs in IDaaS EIAM, synchronization is automatically triggered to update the application in real time.

    In the Operation section, select the SCIM operation types you want to send: Create Account (CREATE /Users), Update Account (UPDATE /Users), Delete Account (DELETE /Users), Create Group (CREATE /Groups), Update Group (UPDATE /Groups), and Delete Group (DELETE /Groups).

    Note

    The selected operations apply to both incremental data synchronization and full data synchronization.

    Full Scope

    When you perform a full data synchronization (Push Now), only the data types selected in this section that are also within the application's synchronization scope are pushed to the downstream application. For example, you can choose to push only account data.

    The Full Scope section provides two checkboxes: Account and Group. Select the data types you need to push.

    Note

    This setting affects only full data synchronization, not incremental data synchronization.

    Field Mapping

    View and edit the attribute mappings for SCIM provisioning.

    On the Field Mapping tab, you can configure the mapping between SCIM server attributes and local attributes. Three default mappings are provided. The user external ID (appUser.externalId) is required and is mapped to userId. The user name (appUser.userName) is mapped to account name. The display name (appUser.displayName) is mapped by using the expression Coalesce(user.displayName, user.username). You can add or remove mappings.

    After saving the configuration, use the Test Connection feature to verify your settings.

    An administrator can use the Push Now feature to push all accounts within the synchronization scope to the application at once.

    SCIM support

    Platform

    SCIM support

    Retrieve existing users

    Modify existing users

    Link existing users

    Resource Access Management (RAM)

    Yes

    Yes

    No

    No

    Cloud SSO

    Yes

    No

    No

    Yes (implicitly supported by Cloud SSO's name-based overwrite logic)

    Huawei Cloud IAM

    No

    -

    -

    -

    Huawei Cloud IAM Identity Center

    Yes

    Yes

    Yes

    Yes

    Tencent Cloud CAM

    No

    -

    -

    -

    Tencent Cloud Organization Management

    Yes

    Yes

    Yes

    Yes (Usernames cannot be changed.)

    Volcano Engine IAM

    No

    -

    -

    -

    Volcano Engine Cloud Identity Center

    Yes

    No

    No

    No

    AWS IAM

    No

    -

    -

    -

    AWS IAM Identity Center

    Yes

    Yes

    Yes

    Yes

    References