> ## Documentation Index
> Fetch the complete documentation index at: https://superwhisper.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Provisioning

> Automate user provisioning and deprovisioning for your Superwhisper Enterprise account using SCIM.

> **Note:** SCIM configuration is only available after [SAML SSO](/docs/enterprise/saml-sso) has been set up.

## How SCIM Works in Superwhisper

Superwhisper uses **just-in-time (JIT) provisioning**. When you assign users in your identity provider, SCIM grants them permission to sign in via SSO, but their account and seat are **not created until they first log in**. This prevents users who never log in from claiming seats.

The provisioning flow works as follows:

1. Admin assigns users to Superwhisper in the identity provider
2. The identity provider sends SCIM requests to Superwhisper, granting SSO login permission
3. When a user initiates their first SSO login, their account is created and a seat is allocated
4. Deprovisioning a user in your identity provider removes them from your organization, deactivates their license, and frees up their seat

## Email as Username Requirement

Your identity provider **must use email as the unique identifier (userName)** for all SCIM API calls. This is required for Superwhisper to correctly match and manage user identities across your organization.

## Setting Up SCIM

<img src="https://mintcdn.com/superwhisper/OfDtJm9zoQ-GnYR1/images/enterprise/scim_setup.png?fit=max&auto=format&n=OfDtJm9zoQ-GnYR1&q=85&s=cfa7dd992a43f888d153db36a7b2f7a9" alt="SCIM Configuration Interface" width="2950" height="1834" data-path="images/enterprise/scim_setup.png" />

Navigate to the **SCIM** tab on the Authentication page in your dashboard.

### 1. Generate a SCIM Bearer Token

Click **Generate Token** to create a bearer token for authenticating SCIM requests. Copy it now, you'll need it when configuring your identity provider. Regenerating the token invalidates the previous one.

### 2. Copy the SCIM Base URL

Your SCIM base URL will be displayed on the configuration page in the following format:

```
https://api.superwhisper.com/scim/v2
```

### 3. Configure Your Identity Provider

Enter the SCIM base URL and bearer token into your identity provider's provisioning settings. Refer to your provider's SCIM guide for detailed instructions:

* [Okta SCIM provisioning guide](https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_scim.htm)
* [Google Workspace automated provisioning guide](https://support.google.com/a/answer/7681608)
* [Microsoft Entra SCIM provisioning guide](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups)

> **Note:** These provider guides will ask you to enable separate provisioning actions, typically **Create Users**, **Update User Attributes**, and **Deactivate Users**. You can leave **Create Users** enabled — it's safe to turn on, but Superwhisper ignores it and never creates an account or seat from it. Account creation always happens via JIT provisioning on first SSO login, as described above. The action that actually matters here is **Deactivate Users**, which drives automatic deprovisioning when you unassign someone in your identity provider.

### 4. Assign Users and Groups

Once SCIM is configured, assign users or groups in your identity provider. Accounts are created on first login. Assigning a user only grants them permission to sign in.

## Support

Questions about SCIM provisioning? Email [enterprise@superwhisper.com](mailto:enterprise@superwhisper.com), request a shared Slack channel, or schedule a call.