Which identity providers work with Cognocient SCIM?

Any that speak SCIM 2.0 with a bearer token, including Okta, Microsoft Entra ID, OneLogin and JumpCloud. Users, role groups, filtering by userName or externalId, and PATCH (including Okta's and Entra's differing dialects) are supported.

What happens when someone is removed in my identity provider?

Deactivating or deleting them there makes the provider send active=false or DELETE. Their access ends immediately. They cannot get back in by signing in with SSO; an administrator has to reprovision them.

Can SCIM make someone an admin?

No. SCIM can assign developer, finance or viewer. Only the account owner can grant admin, in Team settings. A request that asks for admin is refused with a clear error, not silently downgraded.

Do provisioned users use up seats?

Yes, exactly like invites. A new user holds a seat immediately; when your seat limit is reached, provisioning returns a seat-limit error.

How do I provision users automatically with SCIM?

Connect Okta, Microsoft Entra ID, OneLogin or JumpCloud to Cognocient over SCIM 2.0 to create, update and remove team members automatically. Business plan.

SCIM lets your identity provider manage who is on your Cognocient team, so joiners, movers and leavers are handled where they already happen.

Set it up

Open Settings → Security & SSO → User provisioning and click Create token. Copy it now: it is shown once and stored only as a hash.
In your identity provider, add a SCIM 2.0 application with:
- Base URL: https://api.cognocient.com/scim/v2
- Authentication: bearer token (paste the token)
- Unique identifier: userName (the user's email)
Enable Create users, Update user attributes and Deactivate users. Push groups if you want role assignment by group.

How users map

A SCIM user becomes a team member of your account. Creating one holds a seat and gives them the role from the roles attribute, or your SSO default role if none is sent. When they first sign in through SSO, Cognocient matches them by email and completes the account; nothing else is needed.

SCIM	Cognocient
`userName`, `emails`	Email (must be a valid address)
`externalId`	Stored so your provider can find the user again
`active: false` / `DELETE`	Access revoked immediately
`roles[].value`	`developer`, `finance` or `viewer`

Groups and roles

Three read/write groups exist, one per assignable role: developer, finance and viewer. Adding a person to a group assigns that role; removing them returns them to your default role. There is deliberately no admin group.

SCIM cannot grant the admin role. Admin is the one role that can change security settings, so only the account owner assigns it, in the app.

Behaviour to know about

Seats: provisioning respects your plan's seat limit. If you downgrade below your current headcount, the newest members are suspended automatically and reinstated on upgrade.
Filtering: filter=userName eq "..." and externalId eq "..." are supported (which is what Okta and Entra use). Other filters return an invalidFilter error.
Removed means removed: a user revoked through SCIM cannot reactivate themselves by signing in with SSO.
Audit: every provisioning change is recorded in the audit log with the actor shown as SCIM.
Tokens: up to 5 active tokens; revoke any at any time. Each shows when it was last used.

Limits

No bulk operations, sorting or ETags. Consumer email addresses that already own a separate Cognocient account cannot be provisioned into yours.