Setting up SCIM 2.0

Yoodli supports SCIM 2.0 for managing user membership and groups through compatible identity providers, including Microsoft Entra ID, Okta, and Google Workspace.

SCIM lets you provision and deprovision Yoodli users, and sync group membership, directly from your identity provider. This helps your team manage user access in one place.

SCIM is available for enterprise customers. If you do not see the SCIM section in your organization settings, contact Yoodli support to enable it for your organization.

SCIM configuration is tied to your Yoodli organization.

Each organization has its own SCIM server URL and bearer token.

SCIM users in your identity provider map to Yoodli users by work email address.

SCIM groups in your identity provider map to Yoodli groups by group name.

SCIM is authoritative for group membership, but not for admin roles.

Yoodli admin and owner roles are still managed inside Yoodli.

Invitations created by SCIM do not consume a seat license until the user signs in.

Go to Org settings > Access and SSO from the admin view.

Find the SCIM 2.0 section.

Click Configure. If SCIM has already been configured, this will say Manage.

Copy the Yoodli SCIM server URL.

Click Generate bearer token and copy the token somewhere safe.

You will need the server URL and bearer token to configure SCIM in your identity provider.

Generating a new bearer token immediately invalidates any previous token for your organization.

SCIM setup varies by identity provider.

For Microsoft Entra ID, use Microsoft’s guide to configuring SCIM provisioning.

For Okta, use Yoodli’s dedicated Okta SCIM Provisioning guide.

When configuring the SCIM enterprise application in Entra ID, make sure the user attribute mapping for emails[type eq "work"].value maps to the email address the user will use to sign in to Yoodli.

If this mapping is incorrect, users may not match to the right Yoodli accounts.

Okta has two separate provisioning mechanisms:

App Assignments provision users.

Push Groups create and sync groups.

You need both for full automation.

See Yoodli’s Okta SCIM Provisioning guide for step-by-step setup, including the common issue where using the same group for assignment and push can cause silent failures.

When a SCIM user is provisioned, their work email is used as their Yoodli email.

If a Yoodli user already exists with that email, the accounts are linked.

A new SCIM user is not added to your Yoodli organization until they are added to a SCIM group that syncs to Yoodli.

When a SCIM user is deprovisioned, their Yoodli user is deleted along with any recordings they made in Yoodli.

SCIM groups map to Yoodli groups by name.

If a Yoodli group with the same name already exists, the SCIM group is linked to it. If not, a new Yoodli group is created.

Groups managed by SCIM show a SCIM managed label in your group list.

You cannot add or remove members of SCIM-managed groups in Yoodli. Membership must be managed in your identity provider.

Group admins can still be updated in Yoodli.

When a SCIM group is deprovisioned, the corresponding Yoodli group is deleted if it has no remaining admins.

Can SCIM grant Yoodli admin or owner roles?
No. SCIM only manages membership and group sync. Admin and owner roles are managed in Yoodli.

What happens if I disable the SCIM integration?
Yoodli will continue accepting SCIM API calls, but it will not modify users or groups while the integration is disabled. Re-enabling SCIM resumes sync.

Can I use SAML SSO and SCIM at the same time?
Yes. SSO handles authentication. SCIM handles user lifecycle and group sync.

Does SCIM support nested groups?
No. Nested groups are not supported in this version.