Automating user management with SCIM

This allows customers to use the SCIM protocol with their IDP to automatically send TrustCloud invites to new users that have been assigned TrustCloud roles, plus automatically remove users from TrustCloud when they are deactivated.

What is SCIM?

The System for Cross-domain Identity Management (SCIM) protocol is an open standard designed to simplify user provisioning and lifecycle management across multiple platforms. Instead of manually inviting or removing users, SCIM automates these processes to keep identity providers (IdPs) like Okta or Azure AD in sync with applications such as TrustCloud. This reduces administrative overhead and strengthens security by ensuring access is always accurate and up-to-date.

How TrustCloud supports SCIM with SSO

TrustCloud’s SCIM integration works alongside your existing Single Sign-On (SSO) configuration. Once enabled, customers can:

1. Automate user invitations and user access revocations within TrustCloud by doing this from your existing Identity Provider (IdP)
2. Use role-based mapping to ensure correct access levels across the platform. Map IdP attributes to TrustCloud roles so invited users have the appropriate role in TrustCloud.

Here is more information

1. User Provisioning (SCIM Create)
   When a user is created via SCIM from the customer’s Identity Provider (IdP), such as Azure AD or Okta, the platform automatically generates a new invitation for that user. The user must accept the invitation before gaining access to TrustCloud.
2. User Update (SCIM Update)
   When user attributes such as name, email, or roles are updated through SCIM, the platform directly modifies the corresponding record in the TrustCloud database to reflect the changes.
3. User De-provisioning (SCIM Delete)
   When a user is deleted via SCIM, the system performs a soft delete on the user’s record. This action marks the user as inactive while retaining their data for auditability and potential recovery purposes.
4. Role Assignment
   The SCIM integration supports assigning and updating user roles directly from the IdP. Supported roles are:
   1. Employee
   2. TrustShare Collaborator
   3. Compliance Admin
   4. Platform Admin
      This ensures that user permissions remain synchronized between the IdP and TrustCloud.

Provisioning users with SCIM

1. Enable SCIM provisioning in your IDP’s TrustCloud app.
2. Use the SCIM connector base URL and authentication token provided by TrustCloud.
3. Ensure the IDP sends role attributes that align with your SCIM mapping configuration.
4. Once set up, user changes in the IDP (onboarding, role changes, and deactivation) will automatically sync with TrustCloud.

Configuration guidance

Contact TrustCloud Support to configure SCIM.

Provider-specific notes

Auth0

1. Auth0 does not support the /groups SCIM endpoint. Group-based access must be managed through user updates.
2. Auth0 events (user or org modifications) are handled by TrustCloud’s backend only if SCIM is enabled.

Okta

1. Okta does not send roles via SCIM natively. Use the division or userType attribute, which should be added to the `scimAttributeMapping` as the field to use for `role.`