SCIM Provisioning
Automatically provision, update, and deactivate users from your identity provider with SCIM 2.0
Enterprise supports SCIM 2.0 (System for Cross-domain Identity Management) user provisioning. Connect your identity provider — Okta, Microsoft Entra ID, JumpCloud, or any SCIM 2.0 compatible IdP — and Dokploy will automatically create, update, deactivate, and remove users in your organization as your directory changes. When someone joins the team they get access, and when they leave it is revoked automatically, with no manual cleanup.
SCIM provisioning is an Enterprise feature. It requires a valid license key on self-hosted instances, or an Enterprise Cloud plan.
How it works
- SCIM complements SSO: SSO handles authentication (how users log in), while SCIM handles the user lifecycle (which users exist and whether they are active). They are configured independently — you can use SCIM with or without SSO.
- Each SCIM connection is identified by a provider ID you choose (e.g.
okta) and authenticated with a Bearer token that Dokploy generates for you. - The token is scoped to the organization it was created in. Users provisioned by your IdP are added to that organization with the Member role.
Configure Dokploy
-
Go to Settings → SSO and click Manage SCIM.
-
Copy the SCIM 2.0 endpoint URL. It has the form:
https://your-dokploy-domain.com/api/auth/scim/v2 -
Under Generate token for a new provider, enter a unique provider ID for this IdP connection — lowercase letters, numbers, and dashes (e.g.
okta,entra,jumpcloud) — and click Generate. -
Copy the generated Bearer token.
The Bearer token is displayed only once, right after it is generated. Store it securely and paste it into your IdP's SCIM configuration. To rotate a token, delete the provider and generate a new one, then update your IdP with the new token.
You can configure multiple SCIM providers (one per IdP connection), and delete a provider at any time from the same dialog. Deleting a provider does not remove already-provisioned users — it only stops the IdP from syncing.
Configure your identity provider
In your IdP's SCIM (automatic provisioning) settings, you generally need two values:
- Base URL / Tenant URL: your SCIM endpoint URL (
https://your-dokploy-domain.com/api/auth/scim/v2) - Authentication: OAuth Bearer Token — paste the token generated by Dokploy
Okta
- In the Okta Admin Console, open your app integration and enable SCIM provisioning (or create an app from the SCIM 2.0 Test App (OAuth Bearer Token) template).
- In the Provisioning tab, set the SCIM connector base URL to your Dokploy SCIM endpoint URL.
- Set the unique identifier field for users to
userNameand choose HTTP Header authentication, pasting the Bearer token from Dokploy. - Under Provisioning to App, enable Create Users, Update User Attributes, and Deactivate Users.
- Assign the users you want provisioned to the application.
Microsoft Entra ID (Azure AD)
- In the Microsoft Entra admin center, go to Enterprise applications → your application → Provisioning.
- Set Provisioning Mode to Automatic.
- Set Tenant URL to your Dokploy SCIM endpoint URL and Secret Token to the Bearer token from Dokploy.
- Click Test Connection, save, and assign the users you want provisioned.
Any other SCIM 2.0 compliant IdP works the same way: point it at the endpoint URL and authenticate with the Bearer token.
Supported operations
Dokploy implements the SCIM 2.0 User resource:
| Operation | Endpoint | Description |
|---|---|---|
| Provision | POST /Users | Create a user and add them to your organization |
| List / filter | GET /Users | List provisioned users (supports filter) |
| Read | GET /Users/{id} | Fetch a single user |
| Replace | PUT /Users/{id} | Replace a user's attributes |
| Update | PATCH /Users/{id} | Partial update, including activate/deactivate |
| Deprovision | DELETE /Users/{id} | Remove the user from your organization |
The discovery endpoints (/ServiceProviderConfig, /Schemas, /ResourceTypes) are also available so IdPs can auto-detect capabilities.
The Groups resource is not supported. All provisioned users join the organization with the Member role — to grant broader access, change their role manually or assign a custom role in Dokploy.
User lifecycle
| Action in your IdP | Effect in Dokploy |
|---|---|
| Assign / provision a user | User account is created and added to your organization as Member |
| Update profile (name, email) | The user's attributes are updated |
Suspend / deactivate (active: false) | User is marked Deactivated and all their sessions are revoked |
Reactivate (active: true) | Access is restored |
Unassign / deprovision (DELETE) | User is removed from your organization |
You can see each member's Status (Active / Deactivated) in the users table under Settings → Users.
Limitations
- No group provisioning — the Groups resource is not supported, so group-to-role mapping is not available. Roles are managed in Dokploy.
- Existing users are not linked — SCIM only creates new users. If a user with the same email already exists in Dokploy, provisioning them returns a
409 Conflict. Keep managing existing accounts manually, or remove them so the IdP can provision them fresh. - Tokens are shown once and cannot be rotated in place — delete the provider and generate a new one to rotate.