SCIM Provisioning

SCIM lets your identity provider manage who has access to the Dreamdata Platform. You decide access with groups in your identity provider: put someone in a group you have mapped to a Dreamdata role and they get a seat with that role. Take them out of every mapped group, or unassign them, and their access is removed.

The Dreamdata Platform implements SCIM 2.0, so it works with any identity provider that speaks the standard, including JumpCloud, Okta, Microsoft Entra ID, and OneLogin.

Before you start

You need three things in place:

• SAML set up first. The Set up SCIM button stays disabled until it is. SCIM talks to the same identity provider, but it is a separate application there, with its own key.
• SCIM included in your plan. If you do not see the SCIM provisioning panel, contact your Dreamdata representative.
• The Admin role in the Dreamdata Platform.

Set it up

1. Go to User Management → Security → SCIM provisioning and select Set up SCIM.
2. Select Open SCIM setup. The setup page opens in a new tab.
3. On that page, generate a SCIM API key. Copy the key and the SCIM base URL.
4. In your identity provider, create a SCIM application for Dreamdata and paste in the base URL and the key as a bearer token. The exact screens differ by provider, so follow the SCIM guide for your identity provider.
5. Assign the users and groups that should have access. Assign the groups themselves, not only the people in them, or they will not show up for mapping.
6. Back in the Dreamdata Platform, refresh the Security page. Once your identity provider is connected, the SCIM panel shows your SCIM settings.

Treat the setup link like a password

The setup link does not require authentication. Anyone who opens it can configure provisioning for your account, so do not forward it or paste it into a shared channel.

Creating the SCIM key is what turns provisioning on. If you revoke the key on the setup page, provisioning stops until you generate a new key and paste it into your identity provider. To pause syncing without replacing the key, use Disable instead, described under Turning SCIM off.

Map groups to roles

Under Group role mappings, pick a group from your identity provider, choose a Dreamdata role, give it a priority, and select Add. When your list is ready, select Save mappings.

• Mapped groups decide who has access. Once you have mapped at least one group, people your identity provider manages get a seat only while they are in a mapped group. Members you invited yourself keep their access, as described under Members who already existed.
• Priority settles overlaps. If someone is in several mapped groups, the mapping with the lowest priority number wins. Priority 1 beats priority 3.
• The default role applies while you have no mappings at all: everyone your identity provider assigns gets it. If your plan does not include roles and permissions, everyone gets the default role whatever their groups.

Saving mappings does not change anyone's role straight away. Roles update the next time a sync runs: when you select Sync users, or when your identity provider reports a change to that person's groups.

Apply mappings with Sync users

Sync users, under the mappings, applies your saved mappings to everyone your identity provider manages. It asks you to confirm first, because it can change many roles at once.

The button stays disabled, with the reason shown on hover, until:

• every Dreamdata role has at least one mapped group,
• you have saved any changes to the mappings, and
• syncing is turned on.

Roles are managed in your identity provider

Roles set by SCIM cannot be changed inside the Dreamdata Platform. In the users list, those rows show SCIM in the Managed by column, and their role selector and actions are locked. Change the person's groups in your identity provider instead, and the Dreamdata Platform follows.

Members who already existed

If someone you invited yourself is also assigned in your identity provider and is in a mapped group, the next sync takes them over. Their Managed by value changes from Manual to SCIM and their role comes from their groups. Members you invited who are not in a mapped group are left alone.

What happens when someone leaves

A person loses access, and their seat is freed, when you:

• unassign them from the Dreamdata application,
• delete them in your identity provider, or
• remove them from the last mapped group they were in.

This is the Remove from account mode, shown as User removal in the panel. It is the only mode available today. Their account in your identity provider is not affected.

Your account is never left without an Admin

A sync never removes or demotes the last remaining Admin, never removes the last remaining member, and never removes or demotes the Admin who selected Sync users. The sync finishes, reports Some users skipped, and the activity log shows who was kept and why.

What stays in sync

Your identity provider notifies the Dreamdata Platform as changes happen, so most updates land within minutes:

In your identity provider	In the Dreamdata Platform
User assigned and in a mapped group	Member added with their role
User added to a mapped group	Member added, or their role re-checked if already a member
User removed from their last mapped group	Member removed and their seat freed
User unassigned or deleted	Member removed and their seat freed
Name or email changed	Member details updated
Group renamed or deleted	Group mappings updated

Sync users runs a full sync. It compares your identity provider with the Dreamdata Platform and fixes any difference, so use it if something looks out of date.

If your identity provider ever reports no users at all while your account has members, the sync stops before changing anything. That almost always means a connection problem rather than everyone leaving at once.

Reading the panel

The status at the top of the panel is one of:

• Active: syncing is on and the last sync completed.
• Some users skipped: the last sync completed but did not update some people. The panel says how many.
• Seat limit reached: your identity provider assigned more people than your plan has seats.
• Sync failed: the last sync did not complete. Access is unchanged since the sync before it.
• Paused: syncing is turned off.

Below it:

• Synced users is how many members your identity provider manages. Members you invited yourself are not counted.
• Last sync is when the most recent sync ran.
• Last status is the result of that sync.
• User removal is what happens when someone loses access.

Recent activity

Recent activity lists every change your identity provider sent, newest first: what happened, to whom, and the result. When something was skipped or failed, the reason is shown underneath, for example No seats left on your plan. Use the Skipped and Failed filters to see only those.

Seat limit reached

If your identity provider assigns more people than your plan has seats, the extra people are not added and the panel shows a seat limit banner. Upgrade your plan or remove unused members, then select Sync users to add everyone who was waiting.

Turning SCIM off

Disable in the panel header stops all syncing and keeps your setup, so you can turn it back on later without setting it up again.

Nobody is removed when you disable SCIM. Members' Managed by value changes from SCIM back to Manual, so their roles become editable in the Dreamdata Platform again. While paused, the mappings are read-only.

To resume, select Turn syncing back on, then Sync users to take over members who are in a mapped group again.

Troubleshooting

A group is missing from the group picker

The Dreamdata Platform can only map groups your identity provider has sent. Check that the group itself is assigned to the Dreamdata SCIM application, not only the users in it.

Sync users is disabled

Hover over the button to see why. Usually a role has no mapped group yet: add a mapping for it and save.

Someone in my identity provider has no access

Check that they are in at least one mapped group. If they are, look for them in Recent activity. The most common reason is the seat limit.

Someone lost access after I changed groups

They were removed from their last mapped group. Adding them to a mapped group gives them access back. If you map one of the groups they are already in instead, select Sync users to apply it.

A role change did not apply

Check that the group is mapped and that no mapping with a lower priority number is winning. Saved mapping changes apply on the next sync, so select Sync users to apply them now.

The sync failed after the key was revoked

The SCIM key was revoked on the setup page. Generate a new one there and paste it into your identity provider as the new bearer token.

If something still looks wrong, contact support@dreamdata.io with your account name and the time of the sync.