SCIM provisioning (beta)

System for Cross-domain Identity Management (SCIM) lets you provision and deprovision members of your Semgrep deployment from your identity provider (IdP). You can also use identity provider groups to assign deployment roles and, optionally, manage Semgrep teams. SCIM keeps user access and membership synchronized between your IdP and Semgrep. For example, when you add or remove a user in your IdP, SCIM applies the corresponding change in Semgrep automatically. SCIM manages user access, while SSO manages authentication. You must configure SSO authentication before setting up SCIM. This article covers SCIM provisioning setup. Only the Okta and Microsoft Entra ID workflows documented here are tested and supported during the beta.

​

What SCIM manages

With SCIM enabled, Semgrep supports:

• User provisioning: Create Semgrep members when users are assigned to the Semgrep application in your IdP.
• Deprovisioning: Remove access to the Semgrep deployment when users are unassigned or deactivated in your IdP. Deprovisioning applies to the deployment connected to that directory, not to other deployments the user may belong to under the same organization or auth provider.
• Deployment role assignment: Map IdP groups to Semgrep roles such as Admin, Member, or Read-only.
• Team creation from IdP groups (optional): When Teams (beta) is enabled, IdP groups that follow Semgrep’s [team] naming convention can create Semgrep teams for project-scoped access.

Members provisioned through SCIM are matched and managed by email address. Users who predated the directory connection are matched to their existing Semgrep accounts by email when assigned to the directory.

​

How SCIM works with SSO

SCIM and SSO share your IdP and Semgrep deployment. SSO handles sign-in; SCIM handles membership and roles between sign-ins. Relying on SSO alone often means role and membership changes only apply after the user signs in again. SSO and SCIM work together but serve different purposes:

​

Prerequisites

Before you set up SCIM, confirm you have the following:

• A multi-tenant Semgrep deployment. SCIM isn’t available for single-tenant deployments. If you sign in at a tenant site such as https://YOUR_COMPANY.semgrep.dev instead of https://semgrep.dev, contact Semgrep Support.
• A Semgrep plan that includes SSO. Contact your Semgrep account team if you are unsure whether your plan includes SSO. If you receive the error “Requires migrated SSO connection,” contact Semgrep Support.
• SSO configured and active in your deployment.
• Admin privileges for your Semgrep deployment.
• Permission in your identity provider to manage the Semgrep application. See SCIM provisioning with Okta or SCIM provisioning with Microsoft Entra ID for provider-specific requirements.
• Optional: Enable Teams (beta) only if you want SCIM to create and manage Semgrep teams from IdP groups. Teams isn’t required for user provisioning or deployment-level role mapping.

​

Set up SCIM

Start in Semgrep AppSec Platform, then complete setup in your identity provider using the IdP-specific guide. The Directory Setup Portal walks you through creating or linking an application, configuring provisioning, assigning users and groups, mapping groups to roles, and testing the directory connection. Provider-specific steps differ; follow the complete workflow in the IdP-specific guide.

​

Verify the connection

After you finish the setup workflow in your IdP, confirm that SCIM connection status shows Active under Identity management (SCIM) on the Login methods page. To reopen the Directory Setup Portal later, go to Login methods, find Identity management (SCIM), and click View.

​

Manage deployment roles

During directory setup, or later by reopening the portal, map role groups to Semgrep deployment roles:

​

Manage teams with SCIM

If Teams (beta) is enabled, SCIM can create and manage Semgrep teams from IdP groups. Teams isn’t required for user provisioning or deployment-level role mapping. IdP directory groups map to two distinct Semgrep concepts: deployment role groups and Semgrep teams. Each concept has its own role groups. Use the [team] naming convention so Semgrep can tell them apart.

​

Group naming

To create a Semgrep team from an IdP group, add [team] or [team:<role>] to the end of the group name: Name the group with [team] or [team:<role>] before you assign or push it. A group without that suffix is treated as a deployment role group. Renaming a group that’s already assigned doesn’t trigger team creation. Create a new group with the naming convention, then assign it. Don’t assign deployment roles to team groups in the Directory Setup Portal. See SCIM provisioning with Okta or SCIM provisioning with Microsoft Entra ID for provider-specific team management steps.

​

Identity-provider group behavior

How you assign and sync groups depends on your identity provider:

• Okta separates application Assignments and Push Groups. Use assignment groups to provision users into the deployment, and separate push groups for deployment role mapping and teams. Don’t use the same group for both. See Understand assignments and push groups in the Okta guide.
• Microsoft Entra ID uses group assignment to the Semgrep enterprise application for provisioning, deployment role mapping, and team creation. There is no separate push-groups workflow. Review group membership before assignment, because assigning a group provisions all of its members. See Understand group assignments in the Entra ID guide.

​

Limitations

While this feature is in beta, the following limitations apply:

• SCIM isn’t available for single-tenant deployments.
• Semgrep tested and documented only the Okta and Microsoft Entra ID provisioning workflows. These are the only supported workflows. Other IdPs may work but are not documented or officially supported.
• Once SCIM is active, you can’t manage SSO users or teams through Semgrep AppSec Platform.
• If you assign an existing Semgrep user to the directory, also assign them to a role group for the deployment role you want them to have. Otherwise, Semgrep assigns the default Member role.
• SCIM updates aren’t instantaneous. Okta changes can take up to a minute; Entra ID uses a 40-minute provisioning cycle by default unless you Provision on demand.
• Sub-teams and team-managed projects can’t be controlled through SCIM.
• Disabling SCIM doesn’t deprovision members from the deployment.
• Each SCIM application manages one Semgrep deployment. Multiple deployments can share an SSO connection, but each deployment needs its own SCIM application.

For provider-specific behavior and edge cases, see Okta and Entra ID.

​

Disable SCIM

Disabling SCIM disconnects directory sync and removes the connected directory configuration from Semgrep. Disabling SCIM doesn’t deprovision members from the deployment.

​

See also