SCIM Group Sync for Access Management

You can now manage RudderStack group membership from Okta or Azure Entra ID — push your identity provider (IdP) groups to RudderStack over SCIM, map them to RudderStack groups, and membership stays in sync as users join and leave.

SCIM group sync is in Public Beta and available in the Enterprise plan only. Contact the RudderStack team to enable it for your organization.

See the Group Mapping guide for setup steps and sync behavior.

Why SCIM group sync?

SCIM could already create users in RudderStack, but an admin still had to add each one to the right workspaces and groups by hand. With group sync, you decide who gets what access in your IdP, while workspaces and policies stay in RudderStack.

Key features

• Group push from your IdP: Push groups from Okta or Azure Entra ID to RudderStack over SCIM.
• Flexible mappings: Map one IdP group to several RudderStack groups, or several IdP groups to the same RudderStack group.
• Combined access: A user gets every RudderStack group that any of their IdP groups maps to.
• Automatic sync: Users gain and lose RudderStack groups as they join and leave IdP groups, and when you change a mapping.

Get started

1. Contact the RudderStack team to enable SCIM group sync for your organization.
2. Create your RudderStack groups and configure their workspace policies.
3. Push your groups from Okta or Azure Entra ID.
4. Go to Settings > Access Management > Group Mapping and add a mapping.

Resources

• Group Mapping: Add and manage mappings, and see how membership syncs
• Okta Manual Setup: Set up SSO and SCIM with a custom SAML app, and push groups
• Azure Entra ID SSO Setup: Set up SSO and SCIM, and provision groups