SCIM User Sync

Remarque :

Public preview: SCIM User Sync is currently in public preview.

Cette fonctionnalité est disponible avec le plan de licence Entreprise.

Remarque :

La disponibilité des fonctionnalités dépend de l'offre Cloud que vous utilisez. Pour de plus amples informations, consultez la page Disponibilité des fonctionnalités.

The SCIM (System for Cross-domain Identity Management) directory integration enables enterprises to securely synchronize user identities and lifecycle events between UiPath and their corporate identity providers (IdPs). Building on existing Microsoft Entra ID and Security Assertion Markup Language (SAML)-based Single Sign-On (SSO) integrations, SCIM User Sync automates user creation, updates, and deprovisioning, eliminating manual identity management while maintaining centralized control.

Capacités clés

Automated user lifecycle management

Synchronizes user creation, updates, and deletion between your IdP and UiPath.

User attribute synchronization

User attributes — name, email, job title, department, and other attributes — are automatically updated as directed by the SCIM source directory. Changes are reflected in UiPath without requiring a re-login.

Deprovisioning and compliance

Ensures secure access control and releases license allocations when employees leave the organization, helping you comply with data retention and audit requirements.

Supported identity providers

• Microsoft Entra ID (Azure AD)
• Okta

Supported SCIM operations

Ressource	Opérations	Description
Utilisateurs	GET, POST, PUT, PATCH, DELETE	Retrieve, create, modify, or deactivate users
Groupes	Non pris en charge	Groups and group memberships are not synced through SCIM

SCIM User Sync provisions users only — groups and group memberships are not synced. For how group-based access behaves under each SSO method, see the following Feature comparison by SSO method section.

The SCIM 2.0 server also exposes the standard service discovery endpoints under your SCIM base URL (the SCIM URL from setup, for example https://cloud.uipath.com/{orgId}/identity_/api/scim/v2):

• .../ServiceProviderConfig
• .../ResourceTypes
• .../Schemas

These endpoints accept requests authenticated with your SCIM authorization token and return the supported server capabilities, resource types, and schemas.

User lifecycle management

SCIM manages the following lifecycle events:

• Provisioning: When a user is assigned in the source directory, the IdP pushes the user to UiPath.
• Updating: When a user's attributes change in the source directory, the IdP pushes updates to UiPath.
• Deprovisioning:
  • Deactivate: When a user is deactivated or unassigned in the source directory, UiPath marks them as deactivated.
  • Delete: When a user is deleted from the source directory, UiPath deletes the user.
• Reactivation: When a user is reactivated in the source directory, UiPath reactivates them. Licenses must be reassigned after reactivation.

The following table describes how each lifecycle event affects UiPath:

	Créer (Create)	Mettre à jour (Update)	Désactiver	Supprimer (Delete)
Admin — user and group management	The user becomes available to query and assign groups, roles, and permissions.	User attributes are updated.	All roles and permissions are preserved.	All records of the user are deleted.
Gestion des licences	—	—	The user's license is released and returned to your available pool.	The user's license is released and returned to your available pool.
First-party services (Orchestrator, Automation Hub, Task Mining)	—	—	The user is marked inactive; artifacts that reference them show an inactive indicator.	The user is removed; artifacts that reference them show an inactive indicator.
Autres services	Future release	Future release	Future release	Future release

Remarque :

When a user is deactivated or disabled in your identity provider — not only when they are deleted — UiPath automatically releases their license and returns it to your available pool for reassignment. This lets you reclaim licenses from departing or inactive users without manual cleanup. If the user is later reactivated, licenses must be reassigned.

Méthodes d'autorisation

The following authorization methods are available depending on your identity provider:

Authorization method	Entra ID	Okta
Long-lived bearer token	Pris en charge	Pris en charge
OAuth authorization code grant	Non pris en charge	Pris en charge
OAuth client credentials grant	Pris en charge	Non pris en charge

Directory behavior with SCIM enabled

When SCIM is enabled, UiPath sources directory users exclusively from the users provisioned through SCIM. Only SCIM-provisioned users are returned wherever directory users are searched or queried — including when you search for users in the UiPath admin portal and through the directory API. This applies to both Microsoft Entra ID and SAML integrations:

• Microsoft Entra ID: UiPath does not call the Microsoft Graph API to fetch users — users are served from the SCIM-provisioned directory. (Group search still uses a real-time Graph API call.)
• SAML: Users that were not provisioned through SCIM are filtered out of directory results.

Important :

The set of users who can sign in must be exactly the same as the set of users provisioned through SCIM. Because directory queries return only SCIM-provisioned users, a user who can authenticate but was not provisioned through SCIM cannot be found, assigned permissions, or otherwise managed in UiPath. The users assigned to your SSO application and your SCIM application must be identical.

Feature comparison by SSO method

The following table compares how SCIM User Sync behaves depending on the SSO method configured for your organization:

	Entra ID SSO + SCIM	SAML SSO + SCIM
How are directory users logged in?	Single sign-on using the OpenID Connect (OIDC) protocol via the organization-specific URL.	Single sign-on using SAML 2.0 protocol via the organization-specific URL.
How and when are directory users provisioned?	Users are provisioned from the SCIM source directory to UiPath upon configuration; subsequent updates are pushed asynchronously.	Users are provisioned from the SCIM source directory to UiPath upon configuration; subsequent updates are pushed asynchronously.
How and when are directory user attributes updated?	User attributes are updated in UiPath asynchronously as directed by the SCIM source directory.	User attributes are updated in UiPath asynchronously as directed by the SCIM source directory.
How and when are directory users deprovisioned or deactivated?	Users are deprovisioned or deactivated in UiPath asynchronously as directed by the SCIM source directory.	Users are deprovisioned or deactivated in UiPath asynchronously as directed by the SCIM source directory.
How and when are directory groups provisioned?	Directory groups are not provisioned via SCIM, but are materialized in a cached directory upon permission or role assignment in UiPath.	Directory groups are not provisioned via SCIM.
How is directory group membership evaluated?	Group membership is evaluated with a real-time Microsoft Graph API call.	Group membership is not evaluated via SCIM. Just-in-time (JIT) provisioning rules can place users into local UiPath groups based on SAML claims.
How are directory users searched and assigned permissions?	A call is made to UiPath's cached directory of SCIM-provisioned users. You must be signed in using Enterprise SSO to query directory users.	A call is made to UiPath's cached directory of SCIM-provisioned users. You must be signed in using Enterprise SSO to query directory users.
How are directory groups searched and assigned permissions?	A call is made to UiPath's directory for local users and to Entra ID for directory groups via a real-time Microsoft Graph API call.	Directory groups cannot be queried. JIT provisioning rules can be configured to automatically place users into local UiPath groups.

Mappage des attributs

The following table shows how SCIM attributes map to UiPath user attributes. Your identity provider sends the SCIM attribute; UiPath stores it as the UiPath user attribute.

SCIM attribute	UiPath user attribute	Requis
externalId	Directory identifier used to match and link the user	Oui (Yes)
userName	Nom d'utilisateur (Username)	Oui (Yes)
displayName	Nom affiché	Oui (Yes)
emails[type eq "work"].value	E-mail (Email)
name.givenName	Prénom
name.familyName	Nom de famille
title	Intitulé de poste
addresses[type eq "work"].locality	Ville
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department	Department
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization	Nom de la société

Remarque :

externalId is how UiPath identifies and links each provisioned user, so it must be stable and unique — it is stored as the user's directory ID. Okta populates externalId automatically; in Microsoft Entra ID you must map it explicitly (typically to the user's object ID) in the SCIM attribute mappings.

Your identity provider's attribute mappings must include these required fields before SCIM provisioning is enabled.

Important :

The attributes your identity provider sends must map to the SCIM attributes UiPath expects, as listed in the preceding attribute mapping table. When SAML SSO is in use, the SAML attribute mappings must produce these values — in particular, the userName sent through SCIM must match the identifier used in the SAML assertion, so that a provisioned user and their SSO login resolve to the same UiPath user.

Limitations

• Stale users: Existing inactive users are not automatically deleted. A future update will provide tooling to clean up inactive users.
• Group and group membership sync: Not supported.
• Consistent user sets: The set of users configured for SSO must match the set of users configured for SCIM sync.

Limites de débit

SCIM requests are rate limited per organization:

Type de requête	Limite
Read requests (GET)	300 requests per 5 minutes
Write requests (POST, PUT, PATCH, DELETE)	160 requests per 5 minutes

Requests that exceed these limits receive an HTTP 429 Too Many Requests response. Identity provider connectors back off and retry throttled requests automatically, so provisioning continues without manual intervention.

Guides de configuration

SSO must be configured for your identity provider before SCIM User Sync can be enabled. Setup guides are available for:

• Configuring SCIM User Sync with Microsoft Entra ID
• Configuring SCIM User Sync with Okta