Blog Post
SCIM You Can See Working
Directory provisioning has a quiet failure mode. You map a group called RuleEngine-Admins to the Admin role, your identity provider sends a group called RuleEngine Admins, and nothing happens. No error, no warning. Nobody gets the role, and the first anyone hears of it is a new team lead asking why they cannot publish a release.
AI Rule Engine now shows you that mismatch on the screen where you made it, before it costs anyone access. And provisioning itself has moved onto that screen, so there is nothing left to configure anywhere else.
Provisioning lives on the Single Sign-On screen
Open Single Sign-On from your organization and you will find a Directory provisioning card below your identity provider. Save your identity provider first: provisioning is set up against it.
- Copy the Tenant URL and paste it into your identity provider’s provisioning settings as the SCIM endpoint.
- Choose Generate token and paste the token into the same settings. It is shown once, and only a hash is kept. Afterwards the card shows the start of the token and when it was issued, so you can tell which one your provider holds.
- Map your directory groups to roles and choose Save mappings.
Regenerate token replaces the token, and the old one stops working immediately. Your directory stops provisioning until the new token is pasted in, so treat it as the response to a leaked token rather than routine housekeeping.
Directory provisioning is part of single sign-on, on the Enterprise plan, and is set up by an organization owner or admin.
What provisioning does to your members
Provisioning is SCIM 2.0, so it works with Entra ID, Okta and any other identity provider that speaks it. Your directory becomes the place where membership is decided:
- A person your directory provisions joins the organization with the role their groups map to.
- A person your directory deactivates or deletes is removed from the organization. Their account is kept, exactly as when an admin removes a member by hand.
- The organization’s owner is never changed or removed by provisioning.
- A group that maps to Admin needs an author seat for each person in it. If your plan has none left, that person is not provisioned, and your directory reports why.
The practical effect is the one security teams care about: removing someone from your directory is what removes their access here.
Group to role mapping
Each mapping pairs a Directory group name with a role, Admin or Member. The rules are deliberately conservative:
- A group that is not mapped grants nothing, so creating a group in your directory cannot hand anyone access by itself.
- Someone in more than one mapped group gets the most privileged of their roles.
- With no mappings at all, everyone your directory provisions joins as a Member.
- Owner is never granted by a group.
Group names are matched ignoring capitals and extra spaces, so a difference in case or a stray space never breaks a mapping on its own.
Every mapping tells you whether it worked
Once your directory has sent at least one group, each mapping shows its status right under the row:
| Status | What it means |
|---|---|
| Matched | It matches a group your directory sent, shown with the group’s name and how many members it has. |
| No members | The group exists, but nobody your directory has provisioned is in it, so nobody receives the role. Usually the group’s members are not assigned to the provisioning app in your directory. |
| No match | No group your directory sent has this name, so nobody receives the role. |
No members is the one that used to be invisible. The mapping is spelled correctly, the group really exists, and still nobody gets the role, because the people in it were never assigned to the app on the directory side. Now the screen says so in plain words and tells you where to look.
Did you mean
When a mapping has no match but a provisioned group has a close name, the card asks Did you mean that group. Choose Use this name and the correct spelling is filled in for you. Save the mappings and the status turns to Matched.
It is a small thing, and it is precisely the small thing that breaks provisioning in practice: a hyphen against a space, a plural against a singular, one letter typed twice. Suggestions are only ever advice: nothing is granted on a near miss until you accept the name and save.
Groups nobody mapped
Below the mappings, Provisioned groups with no mapping lists every group your directory has sent that no mapping uses, with its member count. Their members join as Member. It is the quickest way to spot the group you meant to map and forgot, or to confirm that every group in play is accounted for.
Before your directory’s first sync, the card simply says that no groups have been provisioned yet, rather than marking every mapping as broken. A warning that fires before there is anything to check would teach you to ignore it.
Open Single Sign-On, generate a token, and connect your directory.
Visit RuleEngine.ai to try it.
The AI Rule Engine Team