SCIM Provisioning

SCIM (System for Cross-domain Identity Management) enables automatic user provisioning and deprovisioning from your identity provider. When configured, users added to your IdP will automatically get Cronitor accounts, and users removed will be deprovisioned.

Overview

SCIM complements SAML SSO by automating the user lifecycle:

Configure SCIM in Cronitor

Step 1: Access SCIM Configuration

Log into Cronitor as an administrator, navigate to Team Settings, and click the "Configure SCIM" button.

Note: SCIM provisioning requires the Business plan.

Step 2: Generate a SCIM Token

1. Enter a descriptive name for the token (e.g., "Okta SCIM Token")
2. Click Generate Token
3. Copy the token immediately - it will only be displayed once
4. Store the token securely for use in your identity provider configuration

Step 3: Note Your SCIM Endpoint

Your SCIM endpoint URL is:

https://cronitor.io/scim/v2

Configure Your Identity Provider

Okta

1. In Okta Admin Console, go to Applications > Applications
2. Select your Cronitor application (or create a new SCIM app)
3. Go to the Provisioning tab
4. Click Configure API Integration
5. Check Enable API Integration
6. Enter:
   • SCIM connector base URL: https://cronitor.io/scim/v2
   • API Token: Your generated SCIM token
7. Click Test API Credentials to verify
8. Click Save
9. Under Provisioning > To App, enable:
   • Create Users
   • Update User Attributes
   • Deactivate Users

Azure AD (Entra ID)

1. In Azure Portal, go to Enterprise Applications
2. Select your Cronitor application
3. Go to Provisioning
4. Set Provisioning Mode to Automatic
5. Under Admin Credentials:
   • Tenant URL: https://cronitor.io/scim/v2
   • Secret Token: Your generated SCIM token
6. Click Test Connection to verify
7. Click Save
8. Configure attribute mappings as needed
9. Set Provisioning Status to On

OneLogin

1. In OneLogin Admin, go to Applications > Applications
2. Select your Cronitor application
3. Go to Configuration
4. Enter:
   • SCIM Base URL: https://cronitor.io/scim/v2
   • SCIM Bearer Token: Your generated SCIM token
5. Go to Provisioning and enable provisioning
6. Configure user provisioning settings

SCIM Endpoints

Cronitor implements the following SCIM 2.0 endpoints:

User Attributes

Supported User Attributes

Example User Payload

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "user@example.com",
  "name": {
    "givenName": "John",
    "familyName": "Doe"
  },
  "emails": [
    {
      "value": "user@example.com",
      "primary": true
    }
  ],
  "active": true,
  "externalId": "okta-user-12345"
}

Group/Role Mapping

Cronitor exposes three groups that map to user roles:

To assign a role, add the user to the corresponding SCIM group in your IdP.

Default Role

When a user is provisioned via SCIM without a group assignment, or when a user is removed from all groups, they are assigned the Default Role. This setting is shared with SAML JIT provisioning.

Configuring the Default Role

1. Navigate to Team Settings
2. Click Configure SSO
3. Find the Default account role setting under JIT user provisioning
4. Select the desired role: Read-only, User, or Admin
5. Click Save Configuration

When the Default Role is Used

Best Practices

• Set the Default Role to Read-only for maximum security - users can be promoted to higher roles as needed
• If your IdP consistently syncs group memberships, the Default Role primarily serves as a fallback
• Consider your team's workflow when choosing between User and Read-only as the default

Managing SCIM Tokens

Viewing Tokens

Navigate to SCIM Settings to view all active SCIM tokens, including:

• Token name
• Creation date
• Last used timestamp

Rotating Tokens

To rotate a SCIM token:

1. Generate a new token in Cronitor
2. Update your identity provider with the new token
3. Verify provisioning works with the new token
4. Delete the old token in Cronitor

Revoking Tokens

Click Remove next to any token to immediately revoke it. Any identity provider using that token will no longer be able to provision or deprovision users.

Troubleshooting

Common Issues

Testing the Connection

You can test your SCIM configuration using curl:

curl -X GET "https://cronitor.io/scim/v2/ServiceProviderConfig" \
  -H "Authorization: Bearer YOUR_SCIM_TOKEN"

A successful response indicates your token is valid.

Security Best Practices