PersonalBusinessDownloadPricingHelpBlogContact
Get Started
Log In
PersonalBusinessDownloadPricingHelpBlogContactBusiness SalesGet StartedLog In

About SCIM

System of cross-domain identity management (SCIM) can be used to automatically provision members and groups in your Bitwarden organization.

Bitwarden servers provide a SCIM endpoint that, with a valid SCIM API Key, will accept requests from your identity provider (IdP) for user and group provisioning and de-provisioning.

note

SCIM Integrations are available for Enterprise organizations. Teams organizations, or customers not using a SCIM-compatible identity provider, may consider using Directory Connector as an alternative means of provisioning.

Bitwarden supports SCIM v2 using standard attribute mappings and offers official SCIM integrations for:

tip

In addition to the providers listed above, Bitwarden offers a beta integration with Google Workspace. Contact us to learn more.

Setting up SCIM

To set up SCIM, your IdP will need a SCIM URL and API key to make authorized requests to the Bitwarden server. These values are available from your organization's Manage SCIM Provisioning page:

SCIM Provisioning
SCIM Provisioning
tip

We recommend using one of our dedicated guides for setting up a SCIM integration between Bitwarden and Azure AD, Okta, OneLogin, or JumpCloud.

Required attributes

Bitwarden uses standard SCIM v2 attribute names, listed here, however each IdP may use alternate names which are mapped to Bitwarden during provisioning.

User attributes

For each user, Bitwarden will use the following attributes:

  • An indication that the user is active (required)

  • emailª or userName (required)

  • displayName

  • externalId

ª - Because SCIM allows users to have multiple email addresses expressed as an array of objects, Bitwarden will use the value of the object which contains "primary": true.

Group attributes

For each group, Bitwarden will use the following attributes:

  • displayName (required)

  • membersª

  • externalId

ª - members is an array of objects, each object representing a user in that group.

Revoking & restoring access

Once users are provisioned in Bitwarden using SCIM, you can temporarily revoke their access to your organization and its vault items. When a user is temporarily suspended/de-activated in your IdP, their access to your organization will automatically be revoked.

tip

Only owners can revoke and restore access to other owners.

Users with revoked access are listed in the Revoked tab of the Manage People screen and will:

note

Revoked users will still occupy licensed seats, however we are looking at changing this behavior in a future release.

Learn more about revoking and restoring access.

SCIM events

Your organization will capture event logs for actions taken by SCIM integrations, including inviting users and removing users, as well as creating or deleting groups. SCIM-derived events will register from Unknown:

SCIM Events
SCIM Events

Pre-existing users and groups

Organizations with users and groups that were onboarded before activating SCIM, either manually or using Directory Connector, should note the following:

...that exists in the IdP. ...that does not exist in the IdP.
Pre-existing user •Will not be duplicated

•Will not be forced to re-join the organization

•Will not be removed from groups they're already a member of
•Will not be removed from the organization

•Will not have group memberships added or removed
Pre-existing group •Will not be duplicated

•Will have members added according to the IdP

•Will not have pre-existing members removed
•Will not be removed from the organization

•Will not have members added or removed
note

If you are using Directory Connector, make sure to turn syncing off before activating SCIM.


Language

Products

Resources

  • Resource Center
  • Community Forums
  • Security Compliance
  • Success Stories
  • User Reviews
  • Newsfeed
  • Subscribe to Updates
©2022 Bitwarden, Inc.
Terms Privacy Sitemap