Control + SCIM
Provision users and groups with SCIM
With Control as a SCIM client, you can manage the full lifecycle of users and groups in cloud services that expose a SCIM API and act as SCIM servers.
Provision from source systems to cloud services
Control can collect identity data from your source systems, apply rules and map attributes to the format required by the target system.
As a SCIM client, Control manages the full lifecycle of users and groups in cloud services with a SCIM API. Users and groups can be created, updated, deactivated and deleted.
Add SCIM support to an existing integration engine
Control can act as a SCIM broker when your existing integration engine lacks a suitable SCIM integration. Microsoft MIM and Google Workspace are examples where this approach may be relevant.
The existing engine continues to control identity flows, while Control acts as the SCIM client and handles communication with the cloud service’s SCIM API.
Create accounts during sign-in (JIT) with SCIM
During sign-in, Access can verify the user’s identity and pass identity details to Forms in Control. There, the user is guided through self-registration and can add details such as an email address or mobile number.
Control can then create the account in the target system through SCIM. When registration is complete, the user and result are returned to Access, which completes sign-in with a SAML assertion or OIDC token whose claims match the new account.
If needed, the flow can also include approvals and account activation.
Adapted to your systems and flows
For provisioning from a source system or existing integration engine, data can be sent to a Control API endpoint or fetched by Control on a schedule. For self-registration, the flow can instead start when a user signs in through Access.
In every scenario, the integration is designed and verified against your systems, attributes and provisioning needs.