Automatic user provisioning with SCIM
Let Microsoft Entra ID or Okta create, update and deactivate people in AssetTrove automatically.
SCIM is a standard that lets your identity provider keep AssetTrove's list of people and groups up to date for you. When someone joins, changes department or leaves, AssetTrove knows within minutes.
Coming at launch SCIM for users and groups is planned for the first release, tested with Microsoft Entra ID and Okta.
What gets synchronised
| From your identity provider | Becomes in AssetTrove |
|---|---|
| Username / email | Email address |
| First name, last name, display name | Name |
| Active / inactive | Active or deactivated. See What happens when someone leaves |
| Job title, employee number | Job title, employee number |
| Department | Department (created automatically if you allow it) |
| Cost centre | Cost centre, matched on its code |
| Manager | Manager |
| Groups and members | Groups, which you can use for roles and licence rules |
Set it up with Microsoft Entra ID
- In AssetTrove, open the SCIM settings page. Copy the SCIM URL and create a token. The token is shown once.
- In the Entra admin center: Enterprise applications → New application → Create your own application → Integrate any other application you don't find in the gallery. This is a separate app from the one used for SSO.
- Under Provisioning, set the mode to Automatic, paste the SCIM URL as Tenant URL and the token as Secret Token, then select Test Connection.
- Assign the users or groups to provision, and start provisioning.
Note Microsoft includes user provisioning in Entra ID Free. Group provisioning needs Entra ID P1 or higher, which is part of Microsoft 365 Business Premium, E3 and E5. Group-based licence rules in AssetTrove need groups, so they need P1.
Set it up with Okta
In Okta, enable provisioning for your AssetTrove app integration and enter the SCIM URL and token from AssetTrove. Provisioning to apps is a paid Okta capability, so check that your Okta plan includes it.
Google Workspace
Google doesn't push SCIM to custom apps. Sign-in with Google works now; synchronising Google users and groups is on the roadmap.
Things to know
- Fields from SCIM are locked in AssetTrove. You can't edit someone's name or email by hand while SCIM manages them; change it in your identity provider. Fields SCIM doesn't send, such as location, stay editable.
- Invitations are switched off while SCIM is on, to avoid duplicate accounts.
- Existing accounts are adopted. If SCIM creates someone who already exists with the same email, AssetTrove links the existing account instead of making a second one.
- Deleting in your identity provider deactivates in AssetTrove. People are never hard-deleted through SCIM, because their device and licence history must survive.
- Token rotation. You can have two active tokens at once, so you can replace a token without downtime.
- Renamed emails don't create duplicates. People are matched on a stable ID, never on email.