IT Glossary

SCIM

SCIM automates user provisioning and deprovisioning across apps. Learn how SCIM works, how it differs from SAML, and how Corma extends it to every app.

June 8, 2026

SCIM (System for Cross-domain Identity Management) is an open standard that automates the exchange of user identity information between an identity provider and applications. Using a JSON-based REST API, SCIM creates, updates, deactivates, and deletes user accounts automatically, which keeps access in sync across a SaaS stack throughout the employee lifecycle.

How SCIM works

  • An identity provider holds the source-of-truth user directory.
  • When a user is added, changed, or removed, the IdP sends a SCIM API call to each connected app.
  • The app creates, updates, or deactivates the matching account in near real time.
  • Group and role data can sync too, which drives downstream permissions.
  • The result is automated user provisioning and deprovisioning without manual tickets.

SCIM vs SAML

SCIM vs SAML: Key Differences

Dimension SCIM SAML
Job Manage the account lifecycle Authenticate the login
Trigger Joiner, mover, leaver events Each access attempt
Risk it removes Orphaned and ghost accounts Repeated logins, password sprawl
Format JSON / REST XML

Examples and use cases

When a new hire joins, SCIM auto-creates accounts in Google Workspace, Slack, and Jira based on their role. On their last day, SCIM deactivates all of them in one motion, which prevents orphaned accounts that fail audits.

The limit: SCIM only works for apps that expose a SCIM endpoint. Many smaller or legacy SaaS tools do not. Covering those long-tail apps is exactly where a SaaS Management plus IAM layer earns its keep.

Related concepts

FAQ

What does SCIM stand for?

‍System for Cross-domain Identity Management. It standardizes how user accounts are provisioned across applications.

Do I need both SCIM and SAML?

‍Usually yes. SCIM manages the account lifecycle, and SAML or OIDC handles login. Together they cover provisioning and authentication.

What about apps that do not support SCIM?

‍They need an alternative method to stay in sync. Corma handles these long-tail and non-SCIM apps so deprovisioning is not left manual.

Corma automates provisioning for SCIM apps and extends coverage to the apps SCIM cannot reach. Explore user provisioning or request a demo.