SCIM User Provisioning Setup for Wolfia

Overview

SCIM (System for Cross-domain Identity Management) enables automatic user and group synchronization between your identity provider and Wolfia. This provides:

Automatic user provisioning: Assigning someone to the Wolfia app creates their account, active immediately, with no invitation email to accept
Real-time updates: User, group and membership changes in your IdP reach Wolfia within minutes
Automatic deprovisioning: Removing someone from the Wolfia app deactivates their account, so they can no longer sign in
Role assignment: Map your IdP groups to Wolfia roles for automatic permission management
Reduced admin overhead: No manual user management required

How SCIM works

SCIM creates a continuous sync between your identity provider and Wolfia:

Create: When you assign a user to Wolfia in your IdP, they’re automatically created in Wolfia
Update: Changes to user details (name, email, group membership) sync automatically
Delete: Removing a user deactivates their account. Wolfia never deletes the record, so their past answers, contributions and audit history stay attributed to them, and re-assigning them later restores the same account rather than creating a second one
Groups: Your IdP groups sync to Wolfia, and their names can drive roles once role sync is enabled

Sync is one-way. Wolfia reads from your directory and never writes back to it.

SCIM requires SSO to be configured first. If you haven’t set up SSO yet, see our SSO Setup Guide.

Supported identity providers

Wolfia supports SCIM with these providers:

Okta (SCIM 2.0)
Azure Active Directory / Microsoft Entra ID (SCIM 2.0)
Google Workspace (Google Directory API)
OneLogin (SCIM 2.0)
JumpCloud (SCIM 2.0)
Authentik (SCIM 2.0)
Any SCIM 2.0 compatible provider

Prerequisites

Before setting up SCIM:

SSO must be configured - Complete SSO setup first
Admin access to your IdP - You need permissions to configure SCIM
Admin access to Wolfia - Must be an Administrator role
Groups configured in your IdP (if using role assignment)

Setup process

Request SCIM setup

Contact your Wolfia account representative or email support@wolfia.com to:

Enable SCIM/Directory Sync for your organization
Receive your unique SCIM configuration portal link
Ensure SSO is properly configured

You’ll receive a secure setup link via email that provides step-by-step configuration guidance.

Access the configuration portal

Click the Directory Sync setup link provided by Wolfia. You’ll be directed to a guided configuration portal that walks you through each step specific to your identity provider.

Select your identity provider

In the configuration portal:

Choose your identity provider from the list
The portal displays provider-specific instructions
Note the SCIM connection details you’ll need

Common providers:

Okta: SCIM 2.0 endpoint and bearer token
Azure AD: Automatic provisioning setup
Google Workspace: Directory API configuration
Authentik: SCIM endpoint and token configuration

Configure SCIM in your identity provider

The configuration portal provides specific setup details for your IdP:

For Okta:

In Okta Admin Console, go to Applications → Your Wolfia App
Click the “Provisioning” tab
Click “Configure API Integration”
Enter the SCIM Base URL and API Token from the portal
Test the connection
Enable provisioning features: “Create Users”, “Update User Attributes”, “Deactivate Users”
Configure attribute mappings (email, firstName, lastName)

For Azure AD (Entra ID):

In Azure Portal, go to Enterprise Applications → Wolfia
Click “Provisioning” in the left menu
Set Provisioning Mode to “Automatic”
Enter the Tenant URL and Secret Token from the portal
Test the connection
Configure attribute mappings
Set Provisioning Status to “On”

For Google Workspace:

The configuration portal will guide you through OAuth authorization
Grant Wolfia access to your Google Workspace directory
Select which organizational units to sync
Configure user and group sync settings

For Authentik:

In Authentik Admin Interface, create a new Provider
Choose “SCIM Provider” as the type
Enter the SCIM endpoint URL from the portal
Configure the bearer token
Set up property mappings for user attributes
Create an Application and bind the provider

For JumpCloud:

In JumpCloud Admin Portal, go to Applications
Click ”+ Add Application” and select “Custom Application”
Choose “SAML with SCIM User Provisioning”
Enter the SCIM Base URL and API Token from the portal
Test the connection to verify connectivity
Configure attribute mappings:
- Email: Required - Maps to user’s email address
- First Name: Maps to givenName
- Last Name: Maps to surname
Enable provisioning features:
- Create Users: Automatically create users when assigned
- Update User Attributes: Sync attribute changes
- Deactivate Users: Remove access when unassigned
- Push Groups: Sync group memberships (required for role assignment)
Assign users or groups to the Wolfia application

As with every other identity provider, roles come from the groups you push, not from a per-user attribute. See the next step for the group names to create.

Configure role assignment (Optional but Recommended)

Map your IdP groups to Wolfia roles for automatic permission management:Available Wolfia roles:

Administrator: Full access to all features, settings, and user management
Expert: Advanced access to create content, manage integrations, and handle questionnaires
Integration Admin: Connects and maintains integrations, and nothing else. No questionnaires, answers, knowledge base, or organization settings
Standard User: View and interact with shared content, participate in questionnaires

Roles are granted through dedicated groups. You create one group per role in your identity provider and put people in it. There is no separate mapping screen to fill in.Create these groups, named exactly as shown:

Wolfia-Admin               → Administrator
Wolfia-Expert              → Expert
Wolfia-Integration-Admin   → Integration Admin

A Wolfia-User group is optional. Anyone in none of these groups is a Standard User, so you only need groups for the roles you want to grant.

Use these names as written. Two substitutions look reasonable and do the wrong thing:

Naming the group after the team grants nothing. A group called Security Team or Compliance Team conveys no role, so its members stay Standard Users. Create Wolfia-Expert and add those teams to it.
Naming an IT group IT-Admin grants full Administrator, not Integration Admin. If you want IT scoped to integrations only, use Wolfia-Integration-Admin.

If you need a name that differs from these, confirm it with us before you enable role sync rather than after.

Members of a role group must also be assigned to the Wolfia app in your identity provider, and the groups must be pushed to Wolfia (in Okta, the Push Groups tab). A group that is created but never pushed has no effect.

Configure sync settings

In your identity provider, configure what to sync:User sync:

Create users automatically when assigned to Wolfia
Update user attributes (name, email) when changed
Deactivate users when unassigned from Wolfia

Group sync (for role assignment):

Sync group memberships to Wolfia
Update group assignments in real-time
Map groups to Wolfia roles (configured in the portal)

Be careful with “Delete users” if your IdP supports it. We recommend using “Deactivate” instead to preserve user history and data.

Assign users and groups

In your identity provider:

Assign users to the Wolfia application
Assign groups to the Wolfia application (if using role assignment)
Users will be automatically created in Wolfia within minutes

For Okta:

Go to Applications → Wolfia → Assignments
Click “Assign” and choose “Assign to People” or “Assign to Groups”

For Azure AD:

Go to Enterprise Applications → Wolfia → Users and groups
Click ”+ Add user/group” and select users or groups

For Google Workspace:

Users are automatically synced based on organizational unit selection

For Authentik:

Assign users or groups to the Wolfia application
Ensure users have the necessary permissions

Complete setup and test

Click “Finish Setup” in the configuration portal
The system validates the SCIM connection
Initial user sync begins automatically

To test:

Assign a test user to Wolfia in your IdP
Wait 2-5 minutes for sync to complete
Check the Wolfia Admin Panel → Users section
Verify the user appears with correct role
Test login with the user’s SSO credentials

User experience with SCIM

For new users

When a user is assigned to Wolfia in your IdP:

Automatic account creation: User account created in Wolfia within 2-5 minutes
Role assignment: User receives role based on group membership (if configured)
No invitation email: the account is ready immediately; the person signs in with SSO
SSO login: User can immediately log in via SSO

For existing users

When you enable SCIM for an organization with existing users:

Account matching: SCIM matches users by email address
No duplicate accounts: Existing users are updated in place
Role updates: If role assignment is enabled, existing user roles are updated
Seamless transition: Users experience no interruption

For user changes

When a user’s details change in your IdP:

Change	SCIM Action	Result in Wolfia
Name updated	User update	Name updated immediately
Email changed	User update	Email and login updated
Group added	Group sync	Role updated (if mapped)
Group removed	Group sync	Role downgraded (if applicable)
User unassigned	User deactivation	Account deactivated, loses access
User reassigned	User reactivation	Account reactivated, access restored

Role assignment in detail

How role assignment works

Once role sync is enabled for your organization:

Initial assignment: When a user is first synced, Wolfia reads the names of every group they belong to
Role determination: They receive the highest privilege role any of those names grants, ordered Administrator, Expert, Integration Admin, Standard User
Automatic updates: When group membership changes, the role updates within minutes, with a daily reconciliation as a backstop
Default role: Anyone whose groups grant no role is a Standard User

Integration Admin ranks below Expert. Someone in both an Expert group and an Integration Admin group receives Expert, which is the wider role. If you want a person scoped to integrations only, they must not also be in the Expert or Administrator group.

Your directory becomes the source of truth. While role sync is enabled, roles are changed by moving people between groups. A role edited by hand inside Wolfia is overwritten at the next sync, so bulk changes are group edits: add ten people to Wolfia-Expert and all ten become Experts. Two things to settle before you ask us to turn it on:

Service and integration accounts. If an account holds Administrator in Wolfia and drives automation, put it in Wolfia-Admin first. Otherwise the first sync reduces it to Standard User and anything running through it can stop working.
Roles you set manually today. Any role that is not reproduced by group membership will be replaced. Reconcile the two lists before enabling, not after.

Keep at least two Administrators. Wolfia has a safeguard that avoids demoting your last remaining Administrator during a routine group change, but it is a backstop, not a guarantee: removing that person from the directory entirely still deactivates them. Two Administrators removes the risk.

Role hierarchy and permissions

Role	Permissions	Use Cases
Administrator	• Full access to all features • Manage organization settings • Manage users and permissions • Configure integrations • Manage trust portals • Manage billing and integrations	IT Admins, Engineering Leads, Security Administrators
Expert	• Create and manage content • Configure integrations • Approve answers in questionnaires • Manage questionnaires and policies • Collaborate across teams • Cannot manage users, roles, or admin-only settings	Security Team, Compliance Team, Product Managers, Technical Writers
Integration Admin	• Connect, reconnect, and remove integrations • Manage the DocuSign connection • Cannot open questionnaires, answers, or the trust portal • Cannot edit the knowledge base or the documents that feed it • Cannot approve answers • Cannot manage users, roles, or organization settings	IT, Business Systems, and other teams that own connectors but should not see security content
Standard User	• View and interact with shared content • Upload questionnaires and edit answers • View your company’s public trust center • Collaborate with team members • Approve answers, unless your admins restrict approval • Cannot create or manage integrations	All Employees, Contractors, External Collaborators

Example role assignment scenarios

Scenario 1: IT lead who should only touch integrations

Member of Wolfia-Integration-Admin
Receives Integration Admin: can connect and maintain integrations, and cannot open questionnaires, answers or the knowledge base

Scenario 2: Security team member

Member of Wolfia-Expert and “All Employees”
Receives Expert. “All Employees” conveys no role, so it makes no difference

Scenario 3: Regular employee

Member of “All Employees” only
Receives Standard User, the default for anyone in no role group

Scenario 4: In two role groups

Member of both Wolfia-Expert and Wolfia-Admin
Receives Administrator, the higher of the two

Scenario 5: The mistake to avoid

Placed in a group called “IT Admins”, intending integrations-only access
Receives full Administrator, because the name reads as an admin group. Use Wolfia-Integration-Admin instead

Single role limitation: Users can only have one role at a time. If a user is in multiple groups with different role mappings, they receive the highest privilege role.

Reconciliation and sync frequency

SCIM keeps Wolfia synchronized with your IdP through:

Real-time sync: Changes pushed immediately via webhooks (typically 1-5 minutes)
Daily reconciliation: Full sync runs daily to catch any missed updates
Manual sync: Contact Wolfia support to trigger immediate full reconciliation

What syncs in real-time:

User creation, updates, and deactivation
Group membership changes
Role updates (via group changes)

What syncs during reconciliation:

Verification of all users and groups
Correction of any sync discrepancies
Role verification and updates

Monitoring and troubleshooting

Check sync status

In your IdP:
- Check provisioning logs for sync events
- Look for any error messages or warnings
- Verify users are assigned to Wolfia app
In Wolfia Admin Panel:
- Go to Settings → Users
- Verify users appear with correct roles
- Check last login and account status
In the configuration portal:
- View sync event logs
- Check connection health status
- Review recent sync operations

Common issues and solutions

User not syncing to Wolfia

Common causes:

User not assigned to Wolfia app in IdP
Email attribute mapping incorrect
SCIM connection credentials expired

Solutions:

Verify user is assigned to Wolfia in your IdP
Check attribute mappings (email must be included)
Re-validate SCIM credentials in the configuration portal
Review IdP provisioning logs for errors
Contact Wolfia support with error details

User has wrong role

Common causes:

Group membership not synced
The group’s name does not convey the role you intended
User in multiple groups with different mappings

Solutions:

Verify user’s group memberships in IdP
Check the group’s name, then confirm role sync is enabled for your organization
Remove user from groups they shouldn’t be in
Wait 5-10 minutes for sync to complete
Trigger manual reconciliation if needed

Sync stopped working

Common causes:

SCIM credentials expired or rotated
Network/firewall blocking requests
IdP configuration changed

Solutions:

Check SCIM connection status in configuration portal
Re-validate credentials if expired
Review recent IdP configuration changes
Check IdP provisioning logs for errors
Contact Wolfia support for investigation

Group changes not reflecting

Common causes:

Group sync not enabled
Group not assigned to Wolfia app
The group’s members are not assigned to the Wolfia app

Solutions:

Ensure group sync is enabled in your IdP
Verify group is assigned to Wolfia application
Check role mapping exists for the group
Wait 5-10 minutes for sync
Manually trigger reconciliation

Security considerations

Best practices

Least privilege: Only map groups that need elevated permissions to Admin/Expert roles
Regular review: Periodically review role mappings and group memberships
Audit logging: Monitor sync logs for unexpected changes
Test before rollout: Test with a small group before enabling for entire organization

Data sync

SCIM syncs the following data:

User identifiers: Email, first name, last name, external ID
Group memberships: every group you push, whether or not its name grants a role
Status: Active or deactivated

Wolfia does not store your IdP passwords or authentication credentials. All authentication goes through your IdP via SSO.

Disabling SCIM

If you need to disable SCIM:

In your IdP: Turn off provisioning or unassign users
Contact Wolfia support: Request SCIM disconnection
User impact: Existing users remain active but won’t auto-sync

After disabling SCIM, you must manually manage user accounts and roles through the Wolfia Admin Panel.

Need help?

SCIM setup can be complex. Our team is here to help:

Email: support@wolfia.com
Include: Organization name, IdP type, and sync logs/errors
Response time: We typically respond within 1 business day
Setup assistance: We can join a call to help configure SCIM

SSO Setup - Configure Single Sign-On (required before SCIM)
Okta Directory Sync - Sync users and groups directly from Okta
Setting up Wolfia - General admin setup guide
API User Invites - Programmatic user management alternative

Setup

Authentication & access

Audit logs

SCIM User Provisioning Setup for Wolfia

Overview

How SCIM works

Supported identity providers

Prerequisites

Setup process

For Okta:

For Azure AD (Entra ID):

For Google Workspace:

For Authentik:

For JumpCloud:

User experience with SCIM

For new users

For existing users

For user changes

Role assignment in detail

How role assignment works

Role hierarchy and permissions

Example role assignment scenarios

Reconciliation and sync frequency

What syncs in real-time:

What syncs during reconciliation:

Monitoring and troubleshooting

Check sync status

Common issues and solutions

Security considerations

Best practices

Data sync

Disabling SCIM

Need help?

​Overview

​How SCIM works

​Supported identity providers

​Prerequisites

​Setup process

​For Okta:

​For Azure AD (Entra ID):

​For Google Workspace:

​For Authentik:

​For JumpCloud:

​User experience with SCIM

​For new users

​For existing users

​For user changes

​Role assignment in detail

​How role assignment works

​Role hierarchy and permissions

​Example role assignment scenarios

​Reconciliation and sync frequency

​What syncs in real-time:

​What syncs during reconciliation:

​Monitoring and troubleshooting

​Check sync status

​Common issues and solutions

​Security considerations

​Best practices

​Data sync

​Disabling SCIM

​Need help?

​Related guides

Overview

How SCIM works

Supported identity providers

Prerequisites

Setup process

For Okta:

For Azure AD (Entra ID):

For Google Workspace:

For Authentik:

For JumpCloud:

User experience with SCIM

For new users

For existing users

For user changes

Role assignment in detail

How role assignment works

Role hierarchy and permissions

Example role assignment scenarios

Reconciliation and sync frequency

What syncs in real-time:

What syncs during reconciliation:

Monitoring and troubleshooting

Check sync status

Common issues and solutions

Security considerations

Best practices

Data sync

Disabling SCIM

Need help?

Related guides