> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM overview

> Learn how to provision users for Infisical via SCIM.

> [!NOTE]
>
> SCIM provisioning requires [Email Domain Verification](https://infisical.com/docs/documentation/platform/email-domain.md).
> You must verify your organization's email domain before provisioning users via SCIM.

> [!NOTE]
>
> SCIM provisioning can only be enabled when either SAML or OIDC is setup for
> the organization.

> [!NOTE]
>
> SCIM provisioning is a paid feature. If you're using Infisical Cloud, then it
> is available under the **Enterprise Tier**. If you're self-hosting Infisical,
> then you should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise license
> to use it.

You can configure your organization in Infisical to have users and user groups be provisioned/deprovisioned using [SCIM](https://scim.cloud/#Implementations2) via providers like Okta, Azure, JumpCloud, etc.

* Provisioning: The SCIM provider pushes user information to Infisical. If the user exists in Infisical, Infisical sends an email invitation to add them to the relevant organization in Infisical; if not, Infisical initializes a new user and sends them an email invitation to finish setting up their account in the organization.
* Deprovisioning: The SCIM provider instructs Infisical to remove user(s) from an organization in Infisical.

## Email address changes

Infisical identifies a member by their email address, so an update that changes the address is rejected unless your organization [enforces SSO](https://infisical.com/docs/documentation/platform/sso/overview.md#sso-enforcement). With enforcement on, the address comes from your identity provider: the update renames the existing Infisical account, and the member keeps their memberships and project access.

The update is rejected with `409 Conflict` when another Infisical account already uses the new address. Remove or merge that account, then retry the provisioning job.

SCIM providers:

* [Okta SCIM](https://infisical.com/docs/documentation/platform/scim/okta.md)
* [Azure SCIM](https://infisical.com/docs/documentation/platform/scim/azure.md)
* [JumpCloud SCIM](https://infisical.com/docs/documentation/platform/scim/jumpcloud.md)
* [PingOne SCIM](https://infisical.com/docs/documentation/platform/scim/pingone.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.