Automatically provision and deprovision workspace members from your identity provider.
What is SCIM provisioning?
SCIM (System for Cross-domain Identity Management) lets your identity provider manage who has access to your Supernova workspace. Once enabled, the identity provider becomes the source of truth for provisioned users — assigned users are created automatically, profile changes are synced, and deactivated users lose workspace access while their Supernova data is preserved.
Supernova supports SCIM 2.0. SCIM requires SSO to be configured for the workspace.
Supported:
- User provisioning
- User profile updates
- User activation and deactivation
- User deletion
- Provider connection tests
Not supported
- Group provisioning
- Password sync
- Workspace role or seat assignment
Before you start
You need:
- SSO configured for the workspace.
- Workspace Admin or Owner access in Supernova.
- Admin access in your identity provider.
- Allowed SSO email domains configured for every user domain you plan to provision.
Enable SCIM in Supernova
- Open the workspace in Supernova.
- Go to Settings → Security & login → SSO.
- In the SCIM section, enable Enable SCIM provisioning.
- Copy the Base URL.
- Select New SCIM token.
- Enter a token name that identifies the provider — for example, Okta SCIM or Microsoft Entra SCIM.
- Copy the generated token immediately. Supernova only displays it once.
Use the Base URL and token when configuring SCIM in your identity provider.
Configure your identity provider
Use the same Okta application already configured for Supernova SAML SSO.
- In the Okta Admin Console, open the Supernova SAML application.
- In the General tab, select SCIM under Provisioning.
- In the Provisioning tab, enter the Supernova SCIM configuration:
- Set SCIM connector base URL to the Supernova Base URL.
- Set Unique identifier field for users to email.
- Under Supported provisioning actions, select Import New Users and Profile Updates, Push New Users, and Push Profile Updates.
- Set Authentication Mode to HTTP Header and paste your SCIM token into the Authorization field.
- Test connection, then save.
Once the connection is established, Okta allows you to enable provisioning actions. Enable:
- Create Users
- Update User Attributes
- Deactivate Users
Leave Group Push, Group Import, and Sync Password disabled — these are not supported by Supernova.
Use the same Microsoft Entra enterprise application already configured for Supernova SAML SSO.
- In the Microsoft Entra admin center, go to Enterprise apps and open the existing Supernova application.
- Open the Provisioning page.
- Set Authentication Method to Bearer Authentication.
- Set Tenant URL to the Supernova Base URL.
- Set Secret Token to the Supernova SCIM token.
- Test connection, then save.
Once the connection is established, go to the Attribute mapping section:
- Confirm that Provision Microsoft Entra ID Users is turned on.
- Confirm that Provision Microsoft Entra ID Groups is turned off.
How to sync
User creation
When a user is provisioned, Supernova creates them as a workspace member with the Viewer role and no seat assigned. The user's email must match one of the workspace's allowed SSO email domains.
User updates
Supernova syncs name, display name, nickname, email attributes, and avatar URL from the identity provider. Email is treated as the stable user identity — attempts to remove or change a user's email are rejected.
User deactivation
When the provider sends active: false, Supernova suspends the user's workspace access and preserves their data. The user can be reactivated by the provider at any time.
User deletion
A deleted user is fully removed from Supernova. If the same person is provisioned again later, Supernova treats them as a new user.
Rotate SCIM token
- In Supernova, create a new SCIM token.
- Replace the old token in your identity provider.
- Test the provider connection.
- Save the provider configuration.
- Delete the old token in Supernova.
Disable SCIM
- Turn off provisioning in your identity provider.
- Delete the SCIM token in Supernova.
- Disable Enable SCIM provisioning in Supernova if you no longer need the Base URL or token controls.
FAQ
Can SCIM assign workspace roles or seats?
No. SCIM creates users as workspace viewers with no seat assigned. Manage roles and seats in Supernova.
Can SCIM provision groups?
No. Supernova supports user provisioning only. You can still use provider groups to control which users are assigned to the Supernova application.
What happens when a user is deactivated?
The user's workspace access is suspended and their Supernova data is preserved.
What happens when a user is deleted?
The user is fully deleted from Supernova. If the same person is provisioned again later, Supernova treats them as a new user.