SCIM provisioning 🔒

SCIM lets you manage users and groups in an external identity provider and sync them into Budibase.

It is designed for one-way provisioning:

• Budibase receives users and groups from your identity provider.
• Synced users and groups are then managed externally.
• Manual users and groups can still be created and edited in Budibase.

Common providers include Azure Active Directory and Okta.

Access

SCIM provisioning is available on the enterprise plan.

Contact sales to upgrade: budibase.com/contact

Enable SCIM

Open Settings > Auth in the Budibase portal.

Turn on Activated under the SCIM section.

When SCIM is enabled, Budibase shows:

• Provisioning URL
• Provisioning Token

Copy both values into your identity provider.

The provisioning URL uses the current platform URL and the SCIM endpoint:

{platformUrl}/api/global/scim/v2

The provisioning token is the current user API key shown in the SCIM settings screen.

SSO requirement

SCIM provisioning does not disable password-based sign-in on its own.

If you want to require SSO-only login, enable Enforce SSO separately.

Disable SCIM

If SCIM is already enabled and you turn it off, Budibase asks what to do with existing SCIM-provisioned users.

You can choose between:

• Remove SCIM users
• Convert to regular users

Removing SCIM users deletes them permanently.

Converting them keeps the users in Budibase, but they are no longer synced with your identity provider.

Manage synced users

Synced users are matched by email.

When a user is managed through SCIM:

• Their email, first name, and last name are read-only in Budibase.
• Other non-synced fields can still be edited.
• The user is marked as externally synced in the builder.

Manage synced groups

Synced groups are matched by name.

When a group is managed through SCIM:

• The group name is read-only in Budibase.
• Non-synced fields can still be edited.
• The group is marked as externally synced in the builder.

First sync

When SCIM is activated for the first time:

• Existing Budibase users are matched to SCIM users by email.
• Existing groups are matched by name.
• Members already assigned to matched groups are replaced by the SCIM-provisioned members.

Azure Active Directory example

If you are using Azure AD, the provisioning flow is:

1. Create an enterprise application in Azure AD.
   
2. Add the users and groups you want to provision.
3. Open Azure provisioning settings and connect the application.

   

4. Paste the Budibase provisioning URL and token into Azure.
   
   
5. Test the connection, create the provisioning setup, and start provisioning.
   
6. Give the provisioned users app access in Budibase.

If you also need SSO, follow the SSO with Azure AD guide.

After provisioning, assign the required user roles and workspace access in Budibase.