User Provisioning (SCIM)
Overview
User Provisioning automatically creates, updates, and deactivates Learn Amp accounts based on changes in your identity provider - so your Learn Amp user base always reflects who's actually part of your organisation, without anyone needing to manage it by hand.
Learn Amp's provisioning is built on SCIM 2.0 (System for Cross-domain Identity Management), an open, industry-standard protocol. Because it's a standard rather than something proprietary, any SCIM 2.0-compatible identity provider can generally provision users into Learn Amp - Okta and Microsoft Entra ID are our most established integrations, but the underlying endpoint isn't limited to those two.
A word on scope and cost: SCIM provisioning works out of the box for identity providers using standard SCIM 2.0 attributes - this is included as part of your subscription with no extra setup fees. However, if your organisation needs something we haven't supported before - particularly custom attribute mappings or bespoke provisioning behaviour beyond the standard schema - that can involve additional development work, and may come at an additional cost. We've built genuinely custom logic for a handful of customers with unusual requirements (things like mapping employee numbers to managers, or auto-assigning teams by job classification), so we know it's possible - we just want to scope it properly with you first. Speak to your account manager early if you think your setup might be non-standard.
Functionality Breakdown
The SCIM Endpoint
Learn Amp exposes a standard SCIM 2.0 endpoint at /scim_v2, covering:
/scim_v2/Users- create, read, update, deactivate, reactivate, and delete users./scim_v2/Groups- read group (team) information.
Your identity provider authenticates to this endpoint using a bearer token (an API token generated by Learn Amp), and pushes changes as they happen in your directory.
User Lifecycle
Event | What Happens in Learn Amp |
|---|---|
New user provisioned | A Learn Amp account is created and, subject to your invitation settings and hire-date logic, the user is invited |
Profile updated | Changes sync automatically (name, job title, department, manager, etc.) |
User deactivated ( | The Learn Amp account is marked pending deactivation |
User reactivated ( | A previously deactivated account is reactivated, within the grace period |
Standard Attribute Mapping
SCIM Attribute | Learn Amp Field |
|---|---|
| |
| First name |
| Last name |
| Active / deactivated status |
| Job title |
| Time zone |
| Hire date |
| Primary team (found or created automatically by name) |
| Manager (matched by email) |
The Enterprise User extension of the SCIM schema is what unlocks manager, department, division, and hire-date support - the SCIM core schema alone only covers basic attributes like name and email.
Groups and Team Membership
Groups map to Learn Amp teams by displayName. Group membership itself is read-only from the SCIM Groups resource - who belongs to which team is driven from each user's department/team attributes, not from pushing membership changes to the group resource. This keeps a single, consistent source of truth for team membership.
Which Providers Does This Work With?
Okta - full SCIM 2.0 support; see Okta User Provisioning and Okta SCIM Integration.
Microsoft Entra ID - full SCIM 2.0 support, as one of two provisioning options; see Microsoft Entra ID User Provisioning.
Because SCIM 2.0 is an open standard, other SCIM 2.0-compatible identity providers may also work, even where we haven't published a dedicated setup guide. If yours isn't listed, get in touch with your account manager - we can usually assess compatibility quickly.
Pre-requisites
Role Requirements
Action | Required Role |
|---|---|
Be provisioned via SCIM | Any user (automatic, once configured) |
View provisioning integration status | Owner, Admin |
Configure provisioning | Owner, Admin |
Learning Designer, Curator, Reporter, Learner | Cannot configure provisioning |
Technical Requirements
An identity provider with SCIM 2.0 provisioning capabilities.
A Learn Amp API token, generated from within Learn Amp, for your identity provider to authenticate with.
Your Learn Amp subdomain (used to build the SCIM endpoint URL:
https://<subdomain>.learnamp.com/scim_v2).
Quick Start Guide
From the sidebar, select the Settings gear icon, then Integrations.
Find your identity provider's provisioning integration (for example, Okta or Microsoft Entra ID) and generate a Learn Amp API token.
In your identity provider, create or configure the SCIM provisioning connection, pointing it at your Learn Amp SCIM endpoint (
https://<subdomain>.learnamp.com/scim_v2) and pasting in the API token as a bearer token.Configure your invitation-type setting in Learn Amp, to control how and when newly provisioned users are invited.
Test provisioning with a small group of users before rolling out to everyone.
See the provider-specific guide (Okta SCIM Integration or Microsoft Entra ID User Provisioning) for detailed, click-by-click steps.
FAQs
Q: Can I still manually create users with SCIM enabled?
Yes. SCIM and manual user management can work alongside each other, though manual changes to attributes SCIM manages may be overwritten on the next sync.
Q: How often does SCIM sync?
This depends on your identity provider's configuration - most push changes in near real-time as they happen, rather than on a schedule.
Q: What happens if SCIM tries to create a duplicate user?
SCIM uses email address (userName) as the unique identifier. If a user with that email already exists, SCIM updates their profile rather than creating a duplicate.
Q: Can SCIM assign users to specific teams?
Yes. The department attribute maps to primary team, and Learn Amp will find or automatically create a matching team.
Q: Does SCIM handle group membership changes pushed from my identity provider?
No - group membership is read-only in Learn Amp's SCIM implementation. Team membership is driven by each user's own department attribute rather than pushed group changes.
Q: What if I need to sync custom fields or unusual business logic?
This is possible, but requires configuration or development work by our technical team, and may come at an additional cost. Speak to your account manager to scope it.
Q: Is SCIM secure?
Yes. SCIM uses a bearer API token for authentication, and all data is transmitted over HTTPS.
Q: Can SCIM assign Learn Amp roles (Admin, Curator, etc.)?
No. Standard SCIM provisioning doesn't set Learn Amp roles - these are managed separately.
Q: Can I use SCIM with a provider that isn't Okta or Microsoft Entra ID?
Possibly. Our SCIM 2.0 endpoint isn't limited to these two - any SCIM 2.0-compatible provider can generally connect. Contact your account manager to check compatibility.
Troubleshooting
Issue | Solution |
|---|---|
User not being created | Check the user is assigned/pushed to the Learn Amp application in your identity provider, and that the SCIM endpoint URL and token are correctly configured. |
Profile not updating | Verify the attribute mapping in your identity provider and check for sync errors on their side. |
User not deactivated when expected | Ensure they've been unassigned/deactivated in your identity provider, not just removed from a directory list. |
Manager not syncing | Confirm the manager's email matches an existing Learn Amp user and the |
Custom attributes not syncing | Custom mappings require configuration by Learn Amp. Contact your account manager to discuss requirements. |
SCIM errors reported by your identity provider | Contact Learn Amp Support with the error details for investigation. |