> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.markup.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.markup.ai/_mcp/server.

# SCIM Provisioning

> Push users and groups from your identity provider into Markup AI ahead of first login, and keep them in sync.

SCIM lets your identity provider push user and group changes into Markup AI **before anyone signs in**. That means you can pre-assign style-guide visibility and roles to a group, and they apply the moment that group's members first log in. SCIM is optional and sits on top of an existing SSO connection.

> **Note**
>
> Single sign-on and SCIM provisioning are available on the **Enterprise plan**. SCIM sits on an **enterprise SSO connection** (SAML or OIDC) — it isn't available for social login or email-and-password organizations.

## Enable SCIM

#### Open the connection's SCIM tab

In the [console](https://console.markup.ai), go to **Single Sign-On**, open your connection, and select the **SCIM** tab.

#### Turn provisioning on

Toggle **Enabled**. Pausing this later only stops SCIM — SSO logins are unaffected.

![SCIM provisioning tab with endpoint URL, event status, and bearer tokens](/_fern-img/1c30c67f9fd9e018277dd4a5885cb2fb008b6f6fe032d70dd519a5941babdb3f.webp)

#### Copy the endpoint and create a token

Copy the **SCIM 2.0 base URL** and select **New token** to mint a bearer token. Point your IdP's SCIM provisioning at that URL using the token.

> **Tip**
>
> You can hold up to **two active tokens** per connection — enough to rotate a token with zero downtime. Treat a token like a password; it's shown once when created.

#### Configure provisioning in your IdP

In your IdP, enable provisioning for the same application, paste the base URL and token, and choose which users and groups to push.

## What syncs

* **Users** — created, updated, and deactivated as your IdP pushes changes.
* **Groups and memberships** — provisioned ahead of login, so visibility and roles can be assigned before first sign-in.

Provisioning is **eventually consistent**: changes arrive continuously, and a periodic reconcile catches anything missed, so brief drift between your IdP and Markup AI is normal.

## Monitor activity

The SCIM tab shows **Last SCIM event received** and **events in the last 7 days**, so you can confirm your IdP is actually pushing changes. If the last event is old or the count is zero, check the provisioning configuration and token in your IdP.

## Related

#### [Attribute Mapping](/admin/attribute-mapping)

Control how provisioned groups map to Markup AI groups.

#### [Groups](/admin/groups)

Pre-assign style-guide visibility to provisioned groups.