SCIM provisioning

With SCIM 2.0, your identity provider (Okta, Microsoft Entra ID, Google and others) decides who is on the team. Assigning someone to MorphGate invites them; deactivating them removes them. SCIM manages people only, not groups or vault access.

On morphgate.com, SCIM is part of the Business plan and the team trial.

What your provider can do

Create an active user
MorphGate invites that address to the team as a member, by email. If the address is already a member, nothing changes.
Deactivate or delete a user
MorphGate removes them from the team, takes away their vault access, flags those vaults for a key rotation, cancels pending invites for the address, and emails them that they were removed.
Reactivate a user
MorphGate invites the address again.

What it can't do: confirm a new member or give them vaults. That needs vault keys, which only an admin's app has. After someone accepts their invite, an admin confirms them in the app, as for any invite. See Inviting and confirming members. The team's owner can't be removed over SCIM.

Removing someone over SCIM doesn't rotate keys or clean their SSH keys off your servers. Rotate the flagged vaults in the app, and use offboarding for the rest. See Removing members and rotating keys.

Connect your provider

  1. On the team page at morphgate.com, under Provisioning (SCIM), choose Create token. The token is shown once. Copy it now.
  2. In your identity provider, set the SCIM base URL shown on the team page (https://morphgate.com/scim/v2/<team id>) and the token as a bearer token.
  3. Map userName to the person's email address.

The team page shows when the token was created and last used. Replace token makes a new one and stops the old one. Revoke token stops provisioning until you create a new token.

Details for your provider

  • Users only. Supported: create, read, replace, patch (active and externalId) and delete, and filters on userName eq and externalId eq.
  • Not supported: groups, bulk operations, sorting, ETags and password changes.
  • The address is the userName, or the primary email when userName isn't an email address. A user's userName can't be changed.

In the activity log

Changes your provider makes appear in the activity log as Provisioning, without a person's name. Creating and revoking tokens are logged too.

If the team leaves Business

The token keeps working for removing people, so you can still offboard through your provider. Adding or reactivating people is refused until the team is on Business again. Creating a new token needs Business; revoking never does.

Self-hosting

The reference server supports SCIM too. You create the token on its command line. It sends no email, so a provisioned person can't join on their own: an admin invites the address again in the app and passes on the code. See Run your own sync server.