SCIM Provisioning

Available on the Enterprise plan. Currently in beta. Contact sales to learn more.

SCIM (System for Cross-domain Identity Management) lets your identity provider automatically create, update, and deactivate user accounts in Ona. Instead of manually inviting users or removing access, your IdP pushes changes to Ona as they happen in your directory.

How it works

When SCIM is configured, your identity provider communicates with Ona through a SCIM endpoint using a bearer token for authentication. Changes in your IdP directory, such as adding a new employee or disabling an account, are automatically reflected in your Ona organization.

SCIM provisioning is linked to an existing SSO login provider. The linked SSO configuration determines how provisioned users authenticate when signing in to Ona.

Each SCIM bearer token is scoped to one SCIM configuration. The token can list and manage only groups created by that configuration. Groups created by another SCIM configuration, system-managed groups, and direct-share groups are excluded from list results. Requests to retrieve or modify those groups return 404 Not Found.

A SCIM bearer token can list or modify only users owned by its linked SSO configuration. If multiple SCIM configurations link to the same SSO configuration, their tokens share access to those users. Requests for a user owned by a different SSO configuration return 404 Not Found.

Prerequisites

• An active SSO login provider configured in your organization
• Admin-level access to your organization settings in Ona
• Admin access to your identity provider (e.g., Microsoft Entra ID)

Setting up SCIM in Ona

Step 1. Open SCIM configuration

Navigate to Organization Settings > Login and Security. Scroll to the SCIM Provisioning section.

SCIM Provisioning: initial state

Click Setup now to begin.

Step 2. Create a SCIM configuration

In the configuration dialog:

1. Select the Linked SSO configuration. This is the SSO provider that provisioned users will use to sign in
2. Enter a Name for this SCIM configuration
3. Click Create

New SCIM configuration: select SSO provider and name

After creation, Ona displays the SCIM endpoint URL and a bearer token.

Copy the bearer token immediately. It is shown only once and cannot be retrieved later.

You will need both the endpoint URL and the token to configure your identity provider in the next step.

Configuring your identity provider

Microsoft Entra ID

Creating an Enterprise Application

If you don’t already have an Enterprise Application for Ona, create one:

1. Open the Microsoft Entra admin center
2. Navigate to Enterprise Applications
3. Click New application, then select Create your own application
4. Enter a name for the application (e.g., Ona)
5. Select Integrate any other application you don’t find in the gallery (Non-gallery)
6. Click Create

Microsoft Entra: create a non-gallery enterprise application

Configuring provisioning

1. In the Microsoft Entra admin center, navigate to Enterprise Applications and select the application you created for Ona
2. Go to Provisioning and select Provisioning again
3. Set Provisioning Mode to Automatic
4. Under Admin Credentials, configure the following:
   • Authentication Method: Bearer Authentication
   • Tenant URL: Paste the SCIM endpoint URL from Ona
   • Secret Token: Paste the bearer token from Ona
5. Click Test Connection to verify the configuration

Once the test succeeds, save the configuration and enable provisioning.

Scoping users

We recommend provisioning only the users who will use Ona, rather than your entire directory. You can control this with scoping filters in your identity provider.

In Microsoft Entra:

1. In the Provisioning tab, select Mappings
2. Open the mapping for Users or Groups
3. Under Source Object Scope, add a Scoping Filter Group to limit which users are provisioned

For details on building scoping filters, see Microsoft’s scoping filter documentation.

Restricting account creation to SCIM

Once SCIM is configured and enabled, you can require that all organization access goes through SCIM by enabling the Restrict account creation to SCIM policy. When enabled, users who can authenticate via SSO but are not provisioned through SCIM are blocked from joining the organization.

This is useful when you want your identity provider to be the single source of truth for who has access to Ona.

Request limits

SCIM user and group POST, PUT, and PATCH request bodies must contain exactly one JSON value and fit within 8 MiB (8,388,608 bytes). The backend allows 10 seconds to read each admitted body. Each backend instance accepts up to two concurrent body reads per organization, across all its SCIM configurations, and eight across all organizations.

Response	Meaning	Action
413 Request Entity Too Large	The request body exceeds 8 MiB.	Reduce the payload before retrying. For large membership updates, use smaller incremental PATCH requests.
408 Request Timeout	Reading the request body timed out.	Check connectivity and retry with backoff.
429 Too Many Requests	The organization’s request rate limit is exceeded, or the organization or backend body-read concurrency limit is full.	Wait at least the Retry-After duration before retrying with backoff. For concurrency limits, also reduce concurrent uploads.

These admission errors use the SCIM error format. A 429 concurrency admission response includes Retry-After: 1, measured in seconds. The default request rate limit is 100 requests per minute per organization.