> ## Documentation Index
> Fetch the complete documentation index at: https://usepike.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning

> How to provision Pike members and teams with SCIM 2.0 from Okta, Microsoft Entra ID, OneLogin, or JumpCloud.

SCIM provisioning lets your identity provider create, update, and deactivate Pike members, and turn groups into Pike teams, with SCIM 2.0. It works with Okta, Microsoft Entra ID, OneLogin, and JumpCloud. SCIM is available on the Enterprise plan and pairs with [single sign-on](https://usepike.com/docs/integrations/sso.md).

## Connect SCIM provisioning

1. Go to **Workspace settings** → **Security** and create a SCIM token. Pike shows the token once, so copy it before you close the dialog.
2. In your identity provider, turn on SCIM provisioning for the Pike app.
3. Paste the SCIM base URL Pike shows and the token.
4. Assign the users and push the groups that should exist in Pike.

Only workspace admins can create SCIM tokens.

## What syncs

| Identity provider | Pike | Notes |
| - | - | - |
| User | Member | Created, updated, and deactivated by the identity provider |
| Name | Member name | |
| Email | Member email | Used to match existing members |
| Title | Position | |
| Deactivated user | Deactivated member | History is kept |
| Group | Team | |
| Group | Role | Optional group-to-role mapping |

### Source of truth

Once a member is provisioned, your identity provider owns their name, email, and title, and Pike reads them back. Pike-only fields, such as project links, internal notes, allocations, and cost profiles, stay in Pike and are never overwritten.

## Synced records

Every provisioned member shows the identity provider marker and "Last synced {time}" or "Not synced yet".

### Sync issues

Records that fail to sync appear in the **Sync issues** list on the integration page, with the record, the reason, and a **Retry** action. The integration never deletes Pike data on its own. A user removed in the identity provider is deactivated in Pike, never deleted.

## Disconnect

Revoking the SCIM token stops provisioning and keeps all members and teams. Members keep their history.

## Permissions

Provisioned members get the Pike roles set by group-to-role mapping or by an admin. Synced data respects Pike roles and private projects. A private project's tasks never sync out to anyone who cannot see the project in Pike.

## Limits

* SCIM provisioning is available on the Enterprise plan.
* Supported identity providers: Okta, Microsoft Entra ID, OneLogin, and JumpCloud.
* Pike shows the SCIM token once. Create a new token if you lose it.

## Related

* [Single sign-on and SCIM overview](https://usepike.com/integrations/sso): Identity providers, provisioning, and FAQs.
* [Single sign-on](https://usepike.com/docs/integrations/sso.md): SAML 2.0 and OpenID Connect sign-in.
* [Rippling](https://usepike.com/docs/integrations/rippling.md): Provision members from Rippling.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.