SCIM Provisioning

SCIM (System for Cross-domain Identity Management) enables automatic user provisioning and deprovisioning from your identity provider. When configured, users added to your IdP will automatically get Cronitor accounts, and users removed will be deprovisioned.

Overview

SCIM complements SAML SSO by automating the user lifecycle:

Configure SCIM in Cronitor

Step 1: Access SCIM Configuration

Log into Cronitor as an administrator, navigate to Team Settings, and click the "Configure SCIM" button.

Note: SCIM provisioning requires the Business plan.

Step 2: Generate a SCIM Token

1. Enter a descriptive name for the token (e.g., "Okta SCIM Token")
2. Click Generate Token
3. Copy the token immediately - it will only be displayed once
4. Store the token securely for use in your identity provider configuration

Step 3: Note Your SCIM Endpoint

Your SCIM endpoint URL is:

https://cronitor.io/scim/v2

Configure Your Identity Provider

Okta

1. In Okta Admin Console, go to Applications > Applications

2. Select your Cronitor application (or create a new SCIM app)

3. Go to the General tab and ensure Provisioning=SCIM

4. Go to the Provisioning tab

5. Click Edit to configure the API Integration

6. Enter:

   • SCIM connector base URL: https://cronitor.io/scim/v2
   • Unique identifier field for users: userName
   • Supported provisioning actions: Enable Push New Users, Push Profile Updates, and Push Groups
   • Authentication Mode: HTTP Header

7. Paste your SCIM token in the Authorization field. (Note: Okta automatically prefixes it with "BEARER")

8. Click Test API Credentials to verify and click Save

9. Under Provisioning > To App, click Edit and enable:

   • Create Users
   • Update User Attributes
   • Deactivate Users

   Leave Sync Password disabled since Cronitor uses SSO for authentication.

Azure AD (Entra ID)

1. Sign in to the Microsoft Entra admin center as a Cloud Application Administrator or higher
2. Navigate to Entra ID > Enterprise Applications
3. Select your Cronitor application
4. Select the Provisioning tab
5. Set Provisioning Mode to Automatic
6. Under Admin Credentials:
   • Tenant URL: https://cronitor.io/scim/v2
   • Secret Token: Your generated SCIM token from Cronitor
7. Click Test Connection to verify Microsoft Entra ID can connect to Cronitor
8. Enter a Notification Email for provisioning error alerts
9. Click Save
10. Under Mappings, select Provision Microsoft Entra ID Users to review attribute mappings. The key matching attribute is userName.
11. Set Provisioning Status to On
12. Click Save to start the initial synchronization

SCIM Endpoints

Cronitor implements the following SCIM 2.0 endpoints:

User Attributes

Supported User Attributes

Example User Payload

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "user@example.com",
  "name": {
    "givenName": "John",
    "familyName": "Doe"
  },
  "emails": [
    {
      "value": "user@example.com",
      "primary": true
    }
  ],
  "active": true,
  "externalId": "okta-user-12345"
}

Group/Role Mapping

Cronitor exposes three groups that map to user roles:

To assign a role, add the user to the corresponding SCIM group in your IdP.

Default Role

When a user is provisioned via SCIM without a group assignment, or when a user is removed from all groups, they are assigned the Default Role. This setting is shared with SAML JIT provisioning.

Configuring the Default Role

1. Navigate to Team Settings
2. Click Configure SSO
3. Find the Default account role setting under JIT user provisioning
4. Select the desired role: Read-only, User, or Admin
5. Click Save Configuration

When the Default Role is Used

Best Practices

• Set the Default Role to Read-only for maximum security - users can be promoted to higher roles as needed
• If your IdP consistently syncs group memberships, the Default Role primarily serves as a fallback
• Consider your team's workflow when choosing between User and Read-only as the default

Managing SCIM Tokens

Viewing Tokens

Navigate to SCIM Settings to view all active SCIM tokens, including:

• Token name
• Creation date
• Last used timestamp

Rotating Tokens

To rotate a SCIM token:

1. Generate a new token in Cronitor
2. Update your identity provider with the new token
3. Verify provisioning works with the new token
4. Delete the old token in Cronitor

Revoking Tokens

Click Remove next to any token to immediately revoke it. Any identity provider using that token will no longer be able to provision or deprovision users.

Troubleshooting

Common Issues

Testing the Connection

You can test your SCIM configuration using curl:

curl -X GET "https://cronitor.io/scim/v2/ServiceProviderConfig" \
  -H "Authorization: Bearer YOUR_SCIM_TOKEN"

A successful response indicates your token is valid.

Security Best Practices