SCIM configuration

Last published : Nov 12, 2026
The Citrix SecurSpaces™ platform adheres to the System for Cross-domain Identity Management (SCIM) 2.0 specification. Use SCIM for automatic provisioning, synchronization, and deprovisioning of users and groups. The SecurSpaces platform supports both the /Users and /Groups endpoints.
  • Use the /Users endpoint to create, update, delete, and retrieve users. User responses include direct group memberships in the read-only groups attribute when the user belongs to one or more groups.
  • Use the /Groups endpoint to create, update, delete, and retrieve groups. Group list responses include group members, so identity providers can validate memberships without requesting each group separately.
When your identity provider sends separate SCIM name fields, SecurSpaces maps name.givenName and name.familyName to the user's first and last name. If the provider sends name.formatted, SecurSpaces uses that formatted value as the user's display name.
Related information
Configure platform login

Configure the SCIM provider

A token is required to authorize requests between your SCIM provider and the SecurSpaces platform. As an administrator, you can obtain the token from System Configuration > Identity Providers > SCIM Configuration.
https://<your-sds-hostname>/system_configuration/identity_providers/scim
SCIM platform
Ensure that your SCIM provider includes this token in all API requests, using the following authorization header format:
Authorization: Bearer <scim-token>

Okta

To use Okta, set these fields:
  • SCIM connector base URL: https://<your-sds-hostname>/scim
  • Unique identifier field for users: userName
The configuration looks similar to this example:
SCIM Okta configuration
Under users, enable the options that match your provisioning workflow:
SCIM Okta user configuration

Microsoft Entra

To use Microsoft Entra, configure a custom Enterprise Application within your Microsoft Entra tenant.

Add an Enterprise Application

  1. Sign in to the Microsoft Entra admin center with at least Cloud Application Administrator permissions.
  2. Go to Identity > Applications > Enterprise applications > All applications.
  3. Select + New application.
  4. Select Create your own application.
  5. Enter a unique application name, and select Integrate any other application you don't find in the gallery.
  6. Select Create.
SCIM Entra application

Configure provisioning

After the application is created, follow these steps to set up the SCIM connection:
  1. Go to Identity > Applications > Enterprise applications, and select your newly created application.
  2. Under Manage, select Provisioning.
  3. Select + New configuration.
  4. For Select authentication method, select the supported bearer token option.
  5. For Tenant URL, enter your SCIM endpoint URL. For example, https://<your-sds-hostname>/scim.
  6. For Secret token, enter the bearer token provided by SecurSpaces.
  7. Select Test Connection.
  8. Select Save.
Note:
A successful test connection might be required to continue.

PingOne

To use PingOne, set these fields:
  • SCIM base URL: https://<your-sds-hostname>/scim
  • User Filter Expression: Change username to userName, and change Eq to eq.
The configuration looks similar to this example:
PingOne configuration
After configuration, the result looks similar to these examples:
PingOne configuredPingOne configured users

OneLogin

To use OneLogin, set these fields:
  • SCIM base URL: https://<your-sds-hostname>/scim
  • scimusername: Set the value to Email.
The configuration looks similar to these examples:
OneLogin configuredOneLogin configured details
The parameters section looks similar to this example:
OneLogin parameters

Xecurify

To use Xecurify, also known as miniOrange, set these fields:
  • SCIM Base URL: https://<your-sds-hostname>/scim
  • userName: Set the value to E-Mail Address.
The configuration looks similar to these examples:
Xecurify configuredXecurify configured details

Verify group synchronization

After configuring your provider, verify membership changes with a test group and test users.
  1. Provision the test users and group through your identity provider.
  2. Check that member values use the user id returned by SecurSpaces through /Users, not the provider's own user identifier.
  3. Add a user to the group through your provider.
  4. Confirm the membership through /Groups/<group-id>.
  5. Remove the user through your provider.
  6. Confirm that the group no longer lists the user.
SecurSpaces accepts a PATCH removal with a filtered path and no value, for example:
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "remove",
      "path": "members[value eq \"<user-id>\"]"
    }
  ]
}
Replace <user-id> with the SecurSpaces user ID. Only the value eq member filter is supported. Group PATCH requests also support adding or removing a list of members, replacing the list, and removing all members with "path": "members" and no value. Add and replace operations can omit path when value contains the group attributes.
An invalid operation prevents the PATCH membership changes from being saved. A conflict response (409) means another membership update prevented this request from completing; retry the request.
Removing a member, replacing a group's membership, or deleting a group also removes shared-workspace access when the user no longer belongs to the project. Direct project membership or membership through another associated group preserves that access. Removing group membership doesn't delete workspaces owned by the user.

Configure the SecurSpaces platform

No additional configuration is needed on the SecurSpaces platform. SCIM is enabled by default.
You can renew the token at any time. Renewing the token invalidates any previously issued tokens.
SCIM renewal