SCIM provisioning

With SCIM provisioning, your identity provider keeps your Deckbell workspace's members in sync: when you assign someone to the Deckbell app there, they get an account and join the workspace; when you change their name, email or title, Deckbell follows; and when you unassign or suspend them, they're deactivated in Deckbell. SCIM is part of the Enterprise plan.

Before you start

• You're the workspace owner (admins can see the settings but not change the token).
• Your company's email domain is verified under Settings → Security → Single sign-on (see Single sign-on). Deckbell only provisions people whose email is on a verified domain, and only changes names and emails of people on those domains. Most teams set up SSO first and then SCIM, so people are added automatically and sign in with SSO.

Get the URL and token

1. Open Settings → SCIM provisioning (in the Workspace group).
2. Copy the SCIM base URL: https://api.deckbell.com/scim/v2.
3. Choose Generate token and copy it (it starts with dkbscim_). It's shown only once.

Each workspace has one token. Rotate token makes a new one and stops the old one at once (paste the new one into your identity provider); Revoke stops provisioning. Generating and revoking the token is recorded in the audit log.

Okta

1. In the Okta Admin Console, open your Deckbell app (or create a SAML app for it, as in Single sign-on). On the General tab choose Edit, set Provisioning to SCIM, and save.
2. On the Provisioning tab, choose Integration → Edit:
   • SCIM connector base URL: https://api.deckbell.com/scim/v2
   • Unique identifier field for users: userName
   • Supported provisioning actions: Push New Users, Push Profile Updates and Push Groups
   • Authentication Mode: HTTP Header, and paste the SCIM token as the Bearer token
3. Choose Test Connector Configuration, then Save.
4. Under Provisioning → To App, choose Edit and enable Create Users, Update User Attributes and Deactivate Users. Save.
5. Make sure the app's Username format is Email, then assign people (or groups of people) on the Assignments tab.

Microsoft Entra ID

1. In the Microsoft Entra admin center, open Enterprise applications and your Deckbell app (or create a non-gallery app), then Provisioning.
2. Set Provisioning Mode to Automatic. Under Admin Credentials:
   • Tenant URL: https://api.deckbell.com/scim/v2
   • Secret Token: the SCIM token
3. Choose Test Connection, then Save.
4. Under Mappings → Provision Microsoft Entra ID Users, check that userPrincipalName (or mail) maps to userName, and that it's an email address on your verified domain. displayName, givenName, surname, jobTitle, department and Switch([IsSoftDeleted]…) → active are used; other attributes are ignored.
5. Assign users and groups under Users and groups, set Provisioning Status to On and save. Entra syncs every 40 minutes or so; use Provision on demand to try one person right away.

What gets synced

In your identity provider	In Deckbell
Assign someone to the app	They join the workspace as a Member. A new account is created if they don't have one; an existing Deckbell account with that email is added to the workspace.
Change name, email or title	Their name, sign-in email, title and department update.
Unassign, suspend or deactivate	They're deactivated: they lose access, but their issues, comments and messages stay. Their API tokens and connected apps stop working.
Assign them again	They're reactivated with their earlier role.

Deactivating through SCIM works like deactivating a member in Deckbell. The workspace owner can't be deactivated through SCIM. Passwords, phone numbers, addresses and other attributes aren't stored.

Members who joined before you set up SCIM aren't duplicated: your identity provider finds them by email and starts managing them.

Making people admins with a group

Deckbell has two SCIM groups:

• Admins: everyone in it is a workspace admin. Push a group named Admins (or Deckbell Admins) from your identity provider and add people to it; removing someone makes them a Member again.
• Members: everyone in the workspace. Pushing it changes nothing; who's in the workspace comes from who's assigned to the app.

Other group names can't be pushed. The owner's role never changes through SCIM, and pushing the whole Admins group sets exactly who's an admin, so people made admin by hand in Deckbell lose it if they aren't in the group. Role changes are recorded in the audit log.

Provisioning log

Settings → SCIM provisioning lists the latest changes your identity provider made (people added, updated, deactivated, groups changed) and any request Deckbell refused, with the reason, for example an email on a domain that isn't verified. Entries are kept for 90 days. Members added or changed this way also appear in the audit log.

Troubleshooting

• "isn't a verified domain of this workspace": verify the domain under Settings → Security → Single sign-on, or check the user's userName is their work email.
• "already a member of this workspace": the person is already in the workspace; make sure your identity provider matches users on userName.
• 401 Unauthorized: the token was rotated or revoked; paste the current one into your identity provider.
• 403 / Enterprise plan: SCIM needs the Enterprise plan.