> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM directory sync

> Sync assigned Enterprise SSO users from your identity provider into CodeRabbit.

export const EnterprisePlanBadge = ({tip = "This feature is available exclusively as part of the Enterprise plan. Please refer to our pricing page for more information about our plans and features.", title = "Enterprise Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="building-2" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

export const AdminRoleBadge = ({tip = "This feature requires an organization owner, an admin role or the corresponding permission. Regular Members do not have access.", title = "Admin Only", cta = "View roles", href = "/management/roles", disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="lock" color="orange" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

<EnterprisePlanBadge />

<AdminRoleBadge tip="This page requires an admin role. Members do not have access to Enterprise SSO settings." />

SCIM directory sync lets your identity provider provision and deprovision members for a CodeRabbit Enterprise SSO workspace. Workspace admins activate SCIM separately for each Enterprise SSO connection and configure the identity provider with the endpoint URL and bearer token generated by CodeRabbit.

Provisioned members appear in **Workspace Team Management**, including members who have not signed in to CodeRabbit yet.

SCIM is available for Enterprise SSO workspaces. You need a workspace admin role to activate or deactivate SCIM, regenerate its token, and manage group role mappings.

CodeRabbit processes user creation, update, and deletion events from your identity provider. These events add members to the workspace, keep their directory profile and membership current, or remove their active workspace membership.

## Before you start

Make sure you have:

* SAML SSO enabled for your CodeRabbit Enterprise workspace
* An identity provider app for CodeRabbit, such as Okta or Microsoft Entra ID
* A CodeRabbit workspace admin role
* Admin access to your identity provider's SCIM or directory sync settings

## How SCIM affects access and licenses

SCIM controls workspace directory membership. Seat assignment is managed separately in **Workspace Team Management** according to the workspace's seat assignment mode.

Deprovisioning removes the member's active workspace membership. Review seat assignment separately in **Workspace Team Management** when access changes.

## Setup flow

<Steps>
  <Step title="Open SCIM Settings">
    In CodeRabbit, open **Workspace Settings** > **SCIM Settings**. The page lists the Enterprise SSO connections for the selected workspace.
  </Step>

  <Step title="Activate SCIM">
    Find the SSO connection you want to synchronize and select **Activate SCIM**.
  </Step>

  <Step title="Copy the endpoint and token">
    Copy the **SCIM endpoint URL** and **SCIM bearer token** into your identity provider's provisioning settings. The token is shown only once. If you close it before saving it, select **Regenerate token** to create a replacement.
  </Step>

  <Step title="Enable provisioning in your identity provider">
    Enable SCIM provisioning for the CodeRabbit application, then assign the users and groups that should become members of the CodeRabbit workspace.
  </Step>

  <Step title="Validate provisioning">
    Confirm that assigned users appear in **Workspace Team Management**. Update a test user in your identity provider and verify that the change reaches CodeRabbit before rolling out SCIM to the full group.
  </Step>
</Steps>

## Map groups to the Admin role

After SCIM is active and your identity provider has pushed its groups, use **Group role mapping** on the connection card to map a SCIM group to the CodeRabbit Admin role. CodeRabbit currently supports SCIM group mapping for the Admin role only.

If you add more than one mapping, their order controls precedence. The topmost matching group wins for members who belong to multiple mapped groups.

## Manage the connection

* Select **Regenerate token** when the current token is lost or compromised, then replace the token in your identity provider.
* Select **Deactivate** to stop provisioning and invalidate the current token. Provisioning remains off until you activate SCIM again.

<Warning>
  Deactivating SCIM does not remove members who were already provisioned. Review existing membership and seats in **Workspace Team Management** after deactivation.
</Warning>

## What's next

<CardGroup cols={1}>
  <Card title="Enterprise SSO overview" href="/management/sso" icon="key" horizontal>
    Review Enterprise SSO providers, workspace roles, and setup guidance.
  </Card>

  <Card title="Seat assignment" href="/management/seat-assignment" icon="users" horizontal>
    Configure automatic or manual seat assignment for workspace members.
  </Card>

  <Card title="Roles and permissions" href="/management/roles" icon="shield-check" horizontal>
    Review how workspace roles, organization roles, and custom permissions work with provisioned users.
  </Card>
</CardGroup>