What is SCIM user provisioning?

SCIM (System for Cross-domain Identity Management) is an open standard that lets your Identity Provider (IdP) manage your PIM Users automatically. In Akeneo PIM, SCIM provisioning is a Premium feature that works with your Akeneo Product Cloud Single Sign-On (SSO) connection.

Once SCIM is set up, your IdP becomes the single place where you manage PIM access:

• When you assign a person to the Akeneo application in your IdP, the IdP creates their PIM User.
• When you change their IdP groups, the IdP updates their Roles and User Groups in the PIM.
• When you deactivate or remove them in your IdP, the IdP disables their PIM User. If you want to fully remove the user, you can do it from the app interface.

Use SCIM provisioning to manage the entire user access lifecycle:

• Prepare access before day one: new team members exist in the PIM with the right Role and User Group before their first sign-in.
• Remove access when people leave: deactivating someone in your IdP automatically disables their PIM User, without a manual cleanup in the PIM.
• Keep access up to date: when someone changes team, the IdP group change updates their PIM access.
• Meet security and audit requirements: your IT team manages PIM access with the same process and the same audit trail as your other company applications.

SCIM or JIT user onboarding?

Both features create PIM Users from your IdP. They differ in when they run and in how they handle offboarding.

Understand how SCIM provisioning works

Your IdP sends changes (events) to Akeneo PIM on its own schedule. For example, Microsoft Entra ID runs a provisioning cycle about every 40 minutes. To test a setup or apply a change right away, use on-demand provisioning in your IdP.

The sync goes one way, from your IdP to Akeneo PIM. Your IdP is the source of truth, so the User information it sends is read-only in the PIM. Update it in your IdP.

Manage access with your IdP

Mapping Rules turn IdP groups into PIM access. A Mapping Rule can apply in 2 ways:

• Member of: the rule applies when the person belongs to a given IdP group. For example, members of a PIM Merchandisers IdP group get the Editor Role and the relevant User Group.
• Always: the rule applies to every provisioned User. Use it to give everyone a default level of access.

SCIM does not replace your access model. Before you enable provisioning, create the Roles and User Groups you need in Akeneo PIM, then configure the Mapping Rules that assign them. 

The Mapping Activity section lists each permission change applied to a User, so you can check who received which access and when. Only the last 100 updates are displayed.

Understand sign-in with SCIM

SCIM creates and updates Users. It does not sign them in. Provisioned Users sign in to Akeneo PIM through your IdP with SSO.

People who already have a PIM password can use the password sign-in address when needed, for example, if they are not managed by your IdP or the IdP is unavailable.

Offboard SCIM users

Start offboarding in your IdP. Deactivate the person or remove them from the Akeneo application directly in your IdP: at the next provisioning cycle, Akeneo PIM disables their User. To apply it right away, run on-demand provisioning for that person in your IdP.

Configure SCIM provisioning

Before you start

• Your Akeneo Product Cloud is on the Premium plan, and Akeneo has activated SSO and SCIM for you.
• Your SSO connection is active. To set it up, refer to the Set up Akeneo Product Cloud SSO (Single Sign-On) article (add link).
• The Roles and User Groups you want to assign exist in Akeneo PIM.
• You have admin access to the provisioning settings of your IdP.

Connect your IdP to Akeneo PIM

1. In Akeneo PIM, open the System menu > Authentication.
2. Open your SSO connection. Confirm that it has the Active status and that Enable connection is set to Yes. 

3. In the SCIM configuration of the connection, copy the SCIM URL and generate a bearer token. Store the token securely: anyone who has it can create and change your PIM Users.

4. In your IdP, open the provisioning settings of the Akeneo application and paste the SCIM URL and the bearer token. You're ready to Enable Connection.

4. Configure your IdP to send a valid email address, a first name, and a last name for every User.
5. Send the relevant IdP groups if you use Mapping Rules to assign Roles and User Groups.
6. Check that each existing PIM User email matches the email sent by your IdP. Correct any differences before you start provisioning. You can now trigger the initial synchronization from your IdP.

The setup assistant guides you through the provisioning settings of the most common Identity Providers.