> For the complete documentation index, see [llms.txt](https://docs.datasaur.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.datasaur.ai/integrations/scim.md).

# SCIM

Datasaur supports SCIM 2.0 to efficiently provision and sync users within a workspace. Before enabling SCIM, you must first configure [SAML](/integrations/saml.md). Each team workspace can have its own SCIM setup.

## Scope

With SCIM, you can manage workspace users from your identity provider, including:

* Inviting users to a workspace with assigned roles
* Provisioning users individually or in bulk through push groups
* Syncing user profile information (First name, last name)
* Removing users from a Workspace without deleting their account

## How to integrate

Configuration is required on both the Datasaur app and the identity provider. Configuring only one side will not complete the integration.

### Configure in Datasaur app

1. Go to your Workspace and navigate to **Settings** > **API keys**.
2. Generate a key and save it securely. This will be used later on the identity provider app.
3. Go to **SAML & SCIM**.
4. Ensure that SAML 2.0 is already configured.
5. Click **Enable SCIM**. You can stop here if you do not plan to provision users through groups in Okta.
6. If you want to provision users through push groups:
   1. In the **Group to role mapping** section, click **Edit**.
   2. Add each group name that will be pushed to Datasaur and set the desired role. Refer to the [section below](#group-to-role-mapping) for more details.

### Configure in the identity provider

To configure SCIM in your Identity Provider, refer to the guide below based on your provider:

* [Okta](/integrations/scim/okta.md)
* [Microsoft Entra ID](/integrations/scim/microsoft-entra-id.md)

## Group to role mapping

You can map identity provider groups to workspace roles in Datasaur (admin, reviewer, labeler). Consider the following example:

| Identity provider group | Workspace role |
| ----------------------- | -------------- |
| Administrator           | Admin          |
| Manager                 | Reviewer       |
| QA                      | Reviewer       |
| Annotator               | Labeler        |
| Data developer          | Labeler        |

In this example, you have five groups in your identity provider. All users in these five groups will be added to the workspace with the corresponding role after the configuration is properly set (including the push group).

If a user belongs to multiple groups with different roles, Datasaur assigns the highest-priority role using the following order:

1. Admin
2. Reviewer
3. Labeler

For example, if John belongs to both the `Administrator` group and the `QA` group, John will be assigned the Admin role because Admin has higher priority than Reviewer.