User provisioning (SCIM)

Set up SCIM 2.0 under Settings → Security to let your identity provider create, update and remove workspace members.

Owners and Admins can use this page.

Before setupCopy Anchor Link

You need access to your identity provider's provisioning settings. SCIM 2.0 works independently of the sign-in method. SAML is not required.

Turn on SCIMCopy Anchor Link

1. Open Settings → Security.
2. Under User provisioning, click Set up next to SCIM 2.0.
3. Copy the base URL.
4. Click Generate token.
5. Copy the token with the copy icon. Sleak shows it only this once.
6. Click Activate. Your identity provider can connect from now on.

You enter both values in your identity provider in the next step. Activate SCIM before you test the connection there. The base URL is the same for every workspace. The token tells Sleak which workspace a request belongs to.

Set up Microsoft Entra IDCopy Anchor Link

1. Choose Enterprise applications → New application in the Entra admin center.
2. Click Create your own application.
3. Name the application Sleak.
4. Choose Integrate any other application you don't find in the gallery (Non-gallery).
5. Set Provisioning Mode to Automatic under Provisioning.
6. Paste the base URL as Tenant URL under Admin Credentials.
7. Paste the token as Secret Token.
8. Click Test Connection.
9. Click Save.
10. Keep the user mappings under Mappings.
11. Turn off Provision Microsoft Entra ID Groups if you do not need group sync.
12. Assign people or groups with Default Access under Users and groups.
13. Set Provisioning Status to On.
14. Save the setting.

App roles are not required.

Choose the provisioning scopeCopy Anchor Link

The scope decides which people Entra ID creates in Sleak. You set it in the application under Provisioning → Settings → Scope:

• Sync only assigned users and groups: Entra ID provisions only the users and groups you assigned under Users and groups. This is the default, and almost always the right choice.
• Sync all users and groups: Entra ID provisions everyone in your tenant. You rarely want this.

Entra ID provisions in cycles. The first members can take up to 40 minutes to appear.

Set up OktaCopy Anchor Link

1. Choose Applications → Applications → Create App Integration in the Okta Admin Console.
2. Choose SWA - Secure Web Authentication, or SAML 2.0 for existing Okta SAML sign-in.
3. Name the app Sleak.
4. Open General → App Settings → Edit.
5. Set Provisioning to SCIM.
6. Save the change.
7. Open Provisioning → Integration → Edit.
8. Enter the values below.
9. Click Test Connector Configuration.
10. Click Save.
11. Open Provisioning → To App → Edit.
12. Enable Create Users.
13. Enable Update User Attributes.
14. Enable Deactivate Users.
15. Assign the required people or groups under Assignments.
16. Add groups under Push Groups if using group sync.

Sync groupsCopy Anchor Link

1. Enable Sync groups below SCIM 2.0.
2. Push the required groups from your identity provider.
3. Choose each group's purpose in Sleak.

New groups start as teams. Changes apply to all group members immediately. Entra ID sends direct members only, not nested groups. Provision on demand can speed up the first delivery.

Manage roles and teamsCopy Anchor Link

• Group-managed roles follow group membership. Multiple groups can assign multiple roles.
• Users marks managed roles with Managed by your identity provider. Other roles remain editable by hand.
• Groups cannot assign Owner. You can map only roles you hold or lower roles.
• The first role mapping previews affected members.
• Group teams are edited only in the identity provider. Renaming changes only teams created by Sleak. A team can belong to at most one group.

Remove a mapping or disable syncCopy Anchor Link

Teams, memberships and roles remain. Unmapped items become editable under Teams and Users again. Enabling group sync reapplies saved mappings immediately and overwrites intervening manual role changes.

Invitation emailCopy Anchor Link

Sleak sends every member your identity provider creates an invitation email with the link to Sleak. In a workspace that signs in with email and password, the email also contains a password.

You change this with the envelope icon next to Details on the SCIM 2.0 card. The icon is crossed out while the invitation email is off.

• Invitation email: On by default. While it is off, Sleak adds new members without inviting them.
• Per SCIM group: You turn the email off for the members of single groups. A member in several groups gets no email if any of their groups is off.

Sleak sends the invitation about a minute after the member arrives. While a group is off, Sleak waits 15 minutes, because Entra ID sends the group memberships after the users.

When you turn the email on again, Sleak invites every SCIM member who has not been invited yet. The same applies to a member who leaves a group that is off. Nobody gets the invitation twice. A member your identity provider reactivates gets a new one.

Members without an invitation get no reminders to sign in. You can still invite a single member under Users with Resend invitation.

Regenerate the tokenCopy Anchor Link

Click Regenerate and confirm. Sleak revokes the old token immediately. Sync fails until you enter the new token in your identity provider.

Turn off SCIMCopy Anchor Link

Click Details next to SCIM 2.0, then Turn off, and confirm. Sleak revokes the token. Members your identity provider already created stay in the workspace.

Provisioning behaviourCopy Anchor Link

SCIM members have a SCIM badge under Users. Change their names and email addresses in the identity provider.

Related articlesCopy Anchor Link

• Security settings
• Single sign-on (SAML & OIDC)
• Users