What Is SCIM?
SCIM (System for Cross-domain Identity Management) automatically keeps your Tomba workspace in sync with your identity provider. When you add or remove someone in your IdP (like Okta or Azure AD), the change is automatically reflected in Tomba — no manual work needed.
🎯 When to Use SCIM
SCIM is ideal if you use an identity provider that supports it:
Okta
Microsoft Azure AD / Entra ID
OneLogin
JumpCloud
Note: Google Workspace does not support SCIM for custom apps. If you use Google Workspace, use JIT provisioning via SSO instead — it creates accounts automatically when users sign in for the first time.
📋 Requirements
A Tomba Enterprise plan
Owner or Admin access to your Tomba workspace
Admin access to your identity provider
Step 1: Generate a SCIM Token
Go to Settings > Workspace > SCIM.
Click Generate Token.
Optionally, add a description (e.g., "Okta SCIM token").
Click Create.
Copy the token immediately — it will only be shown once.
[Image: scim_generate_token.png] — Upload this image
Important: Store this token securely. If you lose it, you'll need to generate a new one.
Step 2: Configure Your Identity Provider
In your IdP's admin console, set up SCIM provisioning for Tomba:
[Image: scim_endpoint_details.png] — Upload this image
Setting | Value |
SCIM Endpoint URL |
|
Authentication | Bearer Token |
Token | The token you generated in Step 1 |
The exact steps vary by provider — consult your IdP's documentation for configuring SCIM provisioning with a custom app.
✅ What SCIM Does
Once connected, your IdP can automatically:
Create users — New team members are added to your Tomba workspace when they're assigned in the IdP.
Update users — Changes to names or other attributes are synced to Tomba.
Deactivate users — When someone is unassigned or deactivated in the IdP, their Tomba workspace access is revoked.
🔧 Managing SCIM Tokens
You can manage your tokens from Settings > Workspace > SCIM:
View all active tokens with their descriptions, creation dates, and last-used dates.
Revoke a token if you no longer need it or suspect it has been compromised. Your IdP will lose provisioning access immediately.
Generate a new token at any time. Remember to update the token in your IdP after revoking the old one.
💡 Tips
SCIM + SSO work great together. Set up SAML SSO for authentication and SCIM for provisioning.
One token per IdP. If you use multiple identity providers, generate a separate token for each.
Test with a single user before enabling SCIM for your entire organization.
Related Resources
SAML Single Sign-On (SSO) — SSO overview
Set Up SAML SSO — Step-by-step SSO setup guide
SSO Enforcement Modes — Control how your team signs in
Team Member Roles — Understand workspace roles and permissions
Need Help?
Got questions about SCIM? Contact our support team — we're here to help!