SCIM

Provision and manage workspace users through your preferred identity provider.

Datasaur supports SCIM 2.0 to efficiently provision and sync users within a workspace. Before enabling SCIM, you must first configure SAML. Each team workspace can have its own SCIM setup.

Scope

With SCIM, you can manage workspace users from your identity provider, including:

• Inviting users to a workspace with assigned roles

• Provisioning users individually or in bulk through push groups

• Syncing user profile information (First name, last name)

• Removing users from a Workspace without deleting their account

How to integrate

Configuration is required on both the Datasaur app and the identity provider. Configuring only one side will not complete the integration.

Configure in Datasaur app

1. Go to your Workspace and navigate to Settings > API keys.

2. Generate a key and save it securely. This will be used later on the identity provider app.

3. Go to SAML & SCIM.

4. Ensure that SAML 2.0 is already configured.

5. Click Enable SCIM. You can stop here if you do not plan to provision users through groups in Okta.

6. If you want to provision users through push groups:

   1. In the Group to role mapping section, click Edit.

   2. Add each group name that will be pushed to Datasaur and set the desired role. Refer to the section below for more details.

Configure in the identity provider

To configure SCIM in your Identity Provider, refer to the guide below based on your provider:

• Okta

• Microsoft Entra ID

Group to role mapping

You can map identity provider groups to workspace roles in Datasaur (admin, reviewer, labeler). Consider the following example:

Identity provider group	Workspace role
Administrator	Admin
Manager	Reviewer
QA	Reviewer
Annotator	Labeler
Data developer	Labeler

In this example, you have five groups in your identity provider. All users in these five groups will be added to the workspace with the corresponding role after the configuration is properly set (including the push group).

If a user belongs to multiple groups with different roles, Datasaur assigns the highest-priority role using the following order:

1. Admin

2. Reviewer

3. Labeler

For example, if John belongs to both the Administrator group and the QA group, John will be assigned the Admin role because Admin has higher priority than Reviewer.