Skip to main content
InviziPoll
Sign inStart free trial

SCIM directory sync

Connect Okta, Entra ID or another IdP to InviziPoll over SCIM: tokens, group-to-role mapping, deprovisioning, and which plans include it.

  • IdP owners, IT admins
  • 4 min read
  • Updated Oct 14, 2026

SCIM keeps InviziPoll's admin accounts in step with your identity provider. Use it when IT already manages people and groups in Okta, Microsoft Entra ID or a similar IdP, and you want joiners, role changes and leavers reflected without inviting everyone by hand.

Note

SCIM lives under Admin → SSO & Provisioning, in the Directory sync (SCIM) section, on the Directory Sync (SCIM) and Group-to-Role Mapping cards.

#Who it's for

IT and IdP owners running joiner, mover and leaver workflows, and teams that want IdP groups to decide who is an Owner, Admin or Member in InviziPoll.

#Which plans include SCIM

SCIM is on when any one of these is true:

  • Your workspace is on Business or Enterprise.
  • Your workspace is on a paid Pro subscription with the SCIM add-on. The add-on is bought from Subscription, where it's offered, and only alongside paid Pro. It isn't available on a trial or on Free.
  • You're on a trial with the Business features preview switched on.

That's the one way SCIM differs from the rest of the Business bundle: SSO, verified domains and SIEM come together at Business, while SCIM can be added to paid Pro on its own. If none of these apply, the section shows upgrade guidance instead of token controls.

Warning

Only the workspace owner can create SCIM tokens and edit group-to-role mappings.

#Prerequisites

SCIM on your plan (see above), admin access to your IdP, and a plan for which IdP groups should map to which InviziPoll roles.

  1. Check your plan. Open Subscription. On paid Pro, add the SCIM add-on where it's offered, or upgrade to Business.
  2. Open SSO & Provisioning. Go to Admin → SSO & Provisioning and scroll to Directory Sync (SCIM).
  3. Copy the base URL. Copy SCIM base URL exactly. Your IdP adds /Users and /Groups itself.
  4. Create a token. Name it under Create token (for example "Okta connector") and click Generate. Copy it straight away; it isn't shown again until you rotate it.
  5. Configure the IdP. Add a SCIM connection with the base URL and the token as the bearer secret. Turn on the user and group operations your provider supports.
  6. Map groups to roles. On Group-to-Role Mapping, add each IdP group ID with its role. Lower Precedence numbers win when someone is in several mapped groups.
  7. Test with a pilot user. Provision a test account, check it appears under Admin → Users, then deprovision it and check it's deactivated.

#What deprovisioning does

When your IdP deactivates or deletes someone, InviziPoll ends their sessions, deactivates the account, removes them from the workspace and removes their access to shared folder keys, all in one step. Their account stays visible to owners as deactivated, for the record.

SCIM won't deactivate the workspace's last active owner. Promote another owner first.

Treat SCIM tokens like passwords. Use Rotate if one leaks, and revoke tokens you no longer use.

#If your plan lapses

Reads and deletes keep working after SCIM drops off your plan, and so does deactivation: the "set active to false" update that Okta and Entra ID send when they deprovision someone still goes through. Creates and other updates are refused, including reactivating someone and group changes. So your IdP can still remove a leaver as usual.

#FAQ

Yes, on paid Pro with the SCIM add-on from Subscription where it's offered, or by moving to Business. If you don't see the add-on, contact sales.