iokyz (iokyz) asked a question.
Is it possible to add users via SAML JIT only and de-provision users via SCIM?
Hello,
We have recently added SCIM support for our customers to add to their SAML integrations. We have a number of customers where they would like to continue to have new users added via SAML JIT auto-provisioning, and then automatically cancel their users via SCIM when they leave their organization?
It seems that if we do not give the "Create" permission to the SCIM service, we are not able to get the users in the Okta IDP to by synced with the users who are in our platform account.
Hi, @iokyz (iokyz)
Thank you for posting on our Community page!
You need leave the Create option on as you’d have problems when assigning a user to the application if not.
Without the Create permission enabled, the user profile from Okta and the user profile in the app side will not be linked, thus provisioning/de-provisioning will not be possible.
I would personally recommend using SCIM settings for provisioning/de-provisioning of users rather than having SAML JIT provisioning.
Thank you for reaching out to our Community and have a great day!
_____________________________________________________________________________
Coming soon: Get tips from community managers during Okta Community's first Ask Me Anything event on 6/22
_____________________________________________________________________________
Community members help others by clicking Like or Select as Best on responses. Try it today.
_____________________________________________________________________________