Skip to content
Sanitized AI Help Center

Configure SCIM provisioning

SCIM lets your identity provider create, update, deactivate, and group Sanitized AI accounts for you. Sanitized AI provides a SCIM 2.0 endpoint that accepts a bearer token generated for your organization.

Where to find each setting

The following table shows where each setting lives.

You needGo here
Sanitized AI SCIM URL, token, sync status, and admin groupSanitized AI > My Organization > Sign-in & provisioning > SCIM provisioning
Okta provisioningOkta Admin Console > Applications > Applications > select the app > Provisioning
Microsoft Entra provisioningMicrosoft Entra admin center > Entra ID > Enterprise applications > select the app > Provisioning
Microsoft’s Tenant URL and Secret Token referenceConfigure SCIM provisioning in Microsoft Entra (Microsoft documentation)
Okta sign-inConfigure Okta SSO

The SCIM base URL and the bearer token are only shown in Sanitized AI. Don’t type or change the URL yourself.

1. Generate the SCIM credentials

  1. In Sanitized AI, go to My Organization > Sign-in & provisioning.
  2. Find the SCIM provisioning card.
  3. Copy the SCIM base URL into a secure working note.
  4. Click Generate bearer token. If a token already exists, the button reads Rotate bearer token instead.
  5. Copy the token into your approved secret manager right away, and then click I saved the token.
  6. Record which identity provider application holds the token, and who is responsible for rotating it.

The bearer token is shown only once. If you lose it, generate a replacement and update your identity provider.

2. Configure your identity provider

Create or open the Sanitized AI provisioning application in Okta or Microsoft Entra ID, and then:

  1. Paste the SCIM base URL into the provider’s Tenant URL, SCIM endpoint, or equivalent field.
  2. Choose HTTP Header or Bearer Token authentication. Don’t use basic authentication.
  3. Paste the bearer token into the token or secret field.
  4. Save the integration, and run the provider’s Test connection action.
  5. Turn on both user and group synchronization, if your provider offers them.
  6. Assign one pilot group. Don’t assign the whole company yet.

Sanitized AI supports standard SCIM 2.0 user and group operations, including create, update, deactivation, group membership changes, filtering, and bulk operations.

3. Review user and group mappings

Before the first sync, review the provider’s attribute mappings:

  1. Check that the user’s email is mapped to the SCIM user name or email field.
  2. Check that the user’s active status is synchronized, so offboarding deactivates the Sanitized AI account.
  3. Check that the pilot group is included in the groups pushed to Sanitized AI.
  4. Save any mapping changes, and then run the provider’s preview or import check, if it offers one.

4. Optional: map an admin group

To let a group in your identity provider manage Sanitized AI:

  1. In SCIM provisioning, enter the exact display name of the group in Admin group name.
  2. Click Save SCIM settings.
  3. Make sure your identity provider sends that group and its members over SCIM.

Group names match whatever the capitalization. Members of the group get the Admin access level, and people who leave the group go back to Member. Clearing the setting turns the mapping off.

5. Validate the first sync

  1. Assign a pilot user or group in your identity provider, and then start a provisioning sync.
  2. In Sanitized AI, go back to My Organization > Sign-in & provisioning > SCIM provisioning.
  3. Check that:
    • The status changes from Awaiting first sync to Active.
    • Last sync shows a recent time.
    • Provisioned users and Synchronized groups show the numbers you expect.
    • The admin group, if you set one, is marked as the admin group.
  4. In your identity provider, deactivate or unassign one pilot user who isn’t critical.
  5. Run the sync again, and check that the account is disabled in Sanitized AI.

Don’t widen the assignment until you’ve tested creating, updating, group membership, and deactivation.

How SCIM accounts behave

  • New accounts are created as active Members in the department Unassigned, and don’t get a welcome email. Tell people how to install the extension and sign in, or share Install and sign in.
  • Deactivating someone in your identity provider disables their Sanitized AI account. It doesn’t delete it, so their history stays in your reports.
  • Each active Member and Admin uses a seat.

Rotate or revoke the token

  1. Click Rotate bearer token to create a replacement. The old token stops working right away, so provisioning fails until you finish the next step.
  2. Copy it into your secret manager, update the token in your identity provider, and run a connection test.
  3. Click Revoke token only if the token may have been exposed, or when you retire the integration. Provisioning stops immediately.