SCIM User Provisioning
SCIM (System for Cross-domain Identity Management) enables automatic user provisioning between your identity provider and Learn Amp. This means user accounts can be created, updated, and deactivated automatically based on changes in your HR system or identity provider.
This article explains how SCIM integration works and what it can do for your organisation.
Overview
SCIM provisioning automates user management by:
Creating accounts — new users in your identity provider are automatically added to Learn Amp
Updating profiles — changes to user details sync automatically
Deactivating users — when someone leaves, their Learn Amp account is deactivated
Assigning managers — manager relationships can be synced from your HR system
This reduces manual Admin work and ensures your Learn Amp user base stays in sync with your organisation.
Functionality Breakdown
What SCIM Can Sync
Attribute | Description |
|---|---|
Name | First name and last name |
Primary email address (used for login) | |
Job title | User's role or position |
Department/Team | Primary team assignment |
Manager | Reporting manager relationship |
Hire date | Employment start date |
Time zone | User's preferred time zone |
Custom fields | Organisation-specific attributes (if configured) |
Active status | Whether the user account is active or deactivated |
Supported Identity Providers
Okta — full SCIM 2.0 support with the Learn Amp integration
💡 Tip: SCIM integrations require configuration by Learn Amp in partnership with your IT team. Contact your Customer Success Manager to get started.
Pre-requisites
Role Requirements
Action | Required Role |
|---|---|
Be provisioned via SCIM | Any user (automatic) |
View SCIM integration status | Admin, Owner |
Configure SCIM integration | Admin, Owner (with Learn Amp support) |
Technical Requirements
An Okta account with SCIM provisioning capabilities
The Learn Amp SCIM integration configured in your identity provider
API credentials provided by Learn Amp
Quick Start Guide
Getting Started with SCIM
SCIM integration is set up by Learn Amp in collaboration with your IT team. Here's the typical process:
Contact your Customer Success Manager to express interest in SCIM provisioning.
Provide identity provider details — which system you use and what attributes you want to sync.
Learn Amp configures the integration and provides API credentials.
Your IT team configures your identity provider to connect to Learn Amp.
Test the integration with a small group of users.
Roll out to all users once testing is successful.
What Happens When SCIM is Active
New employees: When added to your identity provider and assigned to the Learn Amp application, they automatically get a Learn Amp account.
Profile updates: Changes in your identity provider (e.g. name change, new manager) sync to Learn Amp.
Leavers: When removed from the Learn Amp application in your identity provider, their Learn Amp account is deactivated.
FAQs
Q: Can I still manually create users with SCIM enabled?
Yes. SCIM and manual user management can work alongside each other. However, for users managed by SCIM, manual changes may be overwritten by the next sync.
Q: How often does SCIM sync?
This depends on your identity provider's configuration. Most providers push changes in near real-time or on a scheduled basis.
Q: What happens if SCIM creates a duplicate user?
SCIM uses email address as the unique identifier. If a user with that email already exists, SCIM will update their profile rather than create a duplicate.
Q: Can SCIM assign users to specific teams?
Yes. The department or team attribute can be mapped to automatically assign users to teams in Learn Amp.
Q: What if I need to sync custom fields?
Custom field mapping is possible but requires configuration. Contact your Customer Success Manager to discuss your requirements.
Q: Is SCIM secure?
Yes. SCIM uses secure API tokens for authentication, and all data is transmitted over HTTPS. Access is restricted to authorised systems only.
Q: Can SCIM assign user roles (Admin, Curator, etc.)?
Standard SCIM doesn't handle Learn Amp roles. Users are typically created as Viewers, and role upgrades are managed manually or through other processes.
Troubleshooting
Issue | Solution |
|---|---|
User not being created | Check that the user is assigned to the Learn Amp application in your identity provider. |
Profile not updating | Verify the attribute mapping in your identity provider and check for sync errors. |
User not deactivated when expected | Ensure they've been removed from the Learn Amp application assignment, not just your directory. |
Manager not syncing | Confirm the manager's email matches an existing Learn Amp user and the mapping is configured correctly. |
SCIM errors in identity provider | Contact your Customer Success Manager with error details for investigation. |