System for cross-domain identity management (SCIM)
As enterprise IT landscapes scale across hybrid multi-cloud environments, decentralized identity management becomes a primary vector for security vulnerability, compliance failure, and operational friction. In large-scale deployments of Pega Platform™, manually maintaining operator accounts, assigning Access Groups, and performing role-based updates across thousands of users introduces severe operational risks, most notably privilege creep and delayed access revocation.
System for Cross-domain Identity Management (SCIM) is an industry-standard protocol that automates identity provisioning between identity providers (IdPs) and enterprise applications. Pega Platform acts as a SCIM 2.0 Service Provider Server, enabling automated user provisioning, profile updates, and deprovisioning through external IdPs such as Microsoft Entra ID, Okta, Ping Identity, ForgeRock, and CyberArk.
By integrating with an external IdP, organizations can centralize identity administration, maintain consistent access management across applications, and automate user lifecycle management. As part of an organization’s security and compliance strategy, SCIM-driven deprovisioning supports timely access revocation when an administrator disables or removes a user account in the identity provider (IdP).
SCIM overview
SCIM is an open standard that uses REST APIs and JSON payloads to automate identity provisioning between an identity provider (IdP) and a service provider (SP).
A typical integration uses the following process:
- The identity provider maintains user identities.
- Changes to users or groups trigger SCIM requests.
- The target application receives the requests and updates its local user records.
- The integration keeps identity information synchronized across systems.
Identity providers such as Microsoft Entra ID, Okta, SailPoint, Ping Identity, ForgeRock, and CyberArk support SCIM, while service providers such as Pega Platform, Salesforce, Zoom, and Amazon Web Services (AWS) use SCIM for identity provisioning.
Strategic integration patterns: Inbound SCIM vs. SAML/OIDC JIT
Lead System Architects frequently evaluate the trade-offs between SAML 2.0 / OpenID Connect (OIDC) Just-In-Time (JIT) provisioning and Inbound SCIM provisioning. While single sign-on (SSO) protocols authenticate users and assert identity attributes during an active browser login, SCIM operates out-of-band through asynchronous system-to-system synchronization.
|
Architectural dimension |
Inbound SCIM 2.0 (Push architecture) |
SAML / OIDC JIT provisioning (Pull architecture) |
|---|---|---|
|
Lifecycle execution |
Asynchronous, event-driven from IdP in real time |
Synchronous, runs only during user interactive login |
|
Deprovisioning and revocation |
Immediate active termination via DELETE or PATCH |
Passive; access remains valid until active session expires |
|
Offline operator state |
Creates and configures Operators before first login |
Creates the Operator record only after user initiates login |
|
Network traffic pattern |
Inbound REST calls from IdP or gateway to Pega |
Client browser HTTP redirects through Identity Federation |
|
Attribute and group scope |
Full deep group membership and custom extension schemas |
Limited to user SAML attributes asserted in auth assertion token |
SCIM architecture in Pega Platform
In an enterprise topology, an identity provider sends SCIM requests to the Pega Infinity™ SCIM REST API endpoints at /api/scim/v2. Pega Infinity uses OAuth 2.0 to authenticate the requests and processes them to create, update, or disable operator records (Data-Admin-Operator-ID). Organizations can use enterprise security controls, such as API gateways, to govern SCIM API traffic.
When Pega Platform receives a SCIM request, it processes the request according to the configured SCIM schemas, attribute mappings, and provisioning settings.
The following table describes common SCIM operations:
|
Operation |
Endpoint |
Purpose |
|---|---|---|
|
Create |
POST /Users |
Provision a user. |
|
Retrieve |
GET /Users/{id} |
Retrieve user information. |
|
Update |
PUT /Users/{id} |
Replace user information. |
|
Modify |
PATCH /Users/{id} |
Update selected attributes. |
|
Remove |
DELETE /Users/{id} |
Deprovision a user. |
|
Manage groups |
/Groups |
Manage Group resources. |
SCIM configuration in Pega Platform
In Pega Infinity Studio, navigate to Configure > Org & Security > SCIM to access the SCIM configuration.
Pega Platform structures configuration across three foundational tabs:
|
Configuration area |
Key artifacts and Rules |
Architectural function |
|---|---|---|
|
SCIM Configuration |
OAuth 2.0 Client Registration, Service REST endpoint URL |
Defines the OAuth 2.0 Client Credentials Grant, assigns Access Roles, and exposes the /api/scim/v2 endpoint. |
|
Schemas & Attribute Mapping |
Core User/Group Schemas, Data Transforms (pzSCIMUserToOperatorMappings) |
Configures standard SCIM schemas, enterprise extensions, and maps JSON payload fields to Pega operator property paths. |
|
Advanced Configuration |
Resource Identifiers, Dynamic System Settings (scim/user/propertyMapping) |
Configures primary (id) and alternate identifiers, enabling flexible correlation between IdP GUIDs and Pega operator IDs. |
For more information, see System for Cross-domain Identity Management.
Check your knowledge with the following interaction:
This Topic is available in the following Module:
Want to help us improve this content?