Skip to main content
SCIM provisioning lets your identity provider create, update, and deactivate Pike members, and turn groups into Pike teams, with SCIM 2.0. It works with Okta, Microsoft Entra ID, OneLogin, and JumpCloud. SCIM is available on the Enterprise plan and pairs with single sign-on.

​
Connect SCIM provisioning

  1. Go to Workspace settings → Security and create a SCIM token. Pike shows the token once, so copy it before you close the dialog.
  2. In your identity provider, turn on SCIM provisioning for the Pike app.
  3. Paste the SCIM base URL Pike shows and the token.
  4. Assign the users and push the groups that should exist in Pike.
Only workspace admins can create SCIM tokens.

​
What syncs

​
Source of truth

Once a member is provisioned, your identity provider owns their name, email, and title, and Pike reads them back. Pike-only fields, such as project links, internal notes, allocations, and cost profiles, stay in Pike and are never overwritten.

​
Synced records

Every provisioned member shows the identity provider marker and “Last synced ” or “Not synced yet”.

​
Sync issues

Records that fail to sync appear in the Sync issues list on the integration page, with the record, the reason, and a Retry action. The integration never deletes Pike data on its own. A user removed in the identity provider is deactivated in Pike, never deleted.

​
Disconnect

Revoking the SCIM token stops provisioning and keeps all members and teams. Members keep their history.

​
Permissions

Provisioned members get the Pike roles set by group-to-role mapping or by an admin. Synced data respects Pike roles and private projects. A private project’s tasks never sync out to anyone who cannot see the project in Pike.

​
Limits

  • SCIM provisioning is available on the Enterprise plan.
  • Supported identity providers: Okta, Microsoft Entra ID, OneLogin, and JumpCloud.
  • Pike shows the SCIM token once. Create a new token if you lose it.