What is user and group provisioning with SCIM?

SCIM provisioning keeps the users and groups in HP Insights in step with your identity provider, such as Microsoft Entra ID, Okta or Ping Identity. You manage users and groups in the identity provider, which becomes the source of truth, and the changes are synchronized to HP Insights, so you don't have to create and maintain them by hand.

How it works

SCIM (System for Cross-domain Identity Management) is a standard way for an identity provider to send user and group changes to another service. To connect the two, HP Insights generates a Tenant URL and a SCIM token. You enter both in the identity provider, which uses them to authenticate to the HP Insights SCIM endpoint and send changes to it securely.

After the connection is set up, the identity provider sends these changes to HP Insights:

• Users and groups created in the identity provider are added to HP Insights.
• Changes to user attributes, such as names and email addresses, and changes to group memberships are synchronized to HP Insights.

SCIM only synchronizes identity information and group memberships. Users still sign in through your identity provider with OpenID Connect or SAML, as they did before.

What each identity provider supports

Group support and the authentication types you can use depend on the identity provider.

Identity provider	Users	Groups	Authentication types
Microsoft Entra ID	Yes	Yes	OpenID Connect or SAML
Okta	Yes	Yes	OpenID Connect
Ping Identity	Yes	No	OpenID Connect

What changes when SCIM is turned on

Once SCIM is set up, administrators manage users and group memberships in the identity provider rather than directly in HP Insights. Because changes made there are synchronized automatically, user access and role assignments can be managed consistently through identity provider groups and group mappings.

Use SCIM as the main way to manage users and groups, rather than importing users into HP Insights. You can still use import to add card information for users.