What is SCIM (System for Cross-domain Identity Management)?
SCIM (System for Cross-domain Identity Management) is an open standard, defined in RFC 7643 and RFC 7644, for automating user account management between an identity provider and cloud applications. It describes a REST API and a common schema for users and groups, so joiners, movers and leavers are reflected in each application without manual work.
How Personal Academy handles it
Personal Academy offers SCIM 2.0 user provisioning and deprovisioning on every paid plan; Groups and the discovery endpoints are incomplete, and no identity provider has been tested end to end yet.
A worked example
Suppose a 300-person software company connects its identity provider to its learning platform through SCIM. When a new engineer is added in the identity provider, an account appears in the learning platform the same day and onboarding courses can be assigned. When someone leaves and is deactivated centrally, their learning account is deactivated too, so nobody has to remember to remove them by hand.
Before SCIM, keeping user accounts in step across many applications meant spreadsheets, custom scripts or manual work by administrators. Each application had its own user API, and every identity provider had to build a separate connector for each one. SCIM gives both sides one shared contract.
The standard has two parts. RFC 7643 defines the schema: a User resource with attributes such as userName, name, emails and active, a Group resource with members, and an enterprise extension for attributes like employee number, department and manager. RFC 7644 defines the protocol: REST endpoints for creating, reading, replacing, patching and deleting those resources, filtering and paging rules, and error formats.
A complete SCIM service also publishes discovery endpoints. ServiceProviderConfig tells the client which optional features are supported, such as PATCH, bulk operations and filtering. Schemas and ResourceTypes describe the attributes the service understands. Identity providers read these endpoints to decide how to talk to the application, and some refuse to connect without them.
In practice the most important operation is deprovisioning. When a person leaves, the identity provider sets active to false or deletes the user, and the application must immediately stop that person from signing in. This closes the gap where a former employee keeps access to a tool nobody remembered to check.
When evaluating SCIM in a product, check which resources and operations are implemented, whether groups can be managed by PATCH, whether discovery endpoints exist, and whether the vendor has tested its endpoint against the identity provider you use. A partial implementation can still handle users well while leaving group management to be done by hand.