Provisioning users

The System for Cross-domain Identity Management (SCIM) specification is designed to make managing user identities in cloud-based applications and services easier.

User provisioning and deprovisioning is the process of managing user accounts in multiple applications via a single application. SCIM streamlines the process of user management and makes it more efficient by eliminating the need to update multiple applications for user-related changes.

You can create, update, or disable users in your Nintex Process Manager site from Microsoft Entra ID, Okta or Postman as described in the following topics:

Known Limitations

The following scenarios are not supported or have known limitations when using SCIM provisioning with Entra ID.

Role-based scoping using appRoleAssignments

Entra ID does not support appRoleAssignments as a scoping filter. This means you cannot create a scoping rule to map a user's Entra ID roles directly to SCIM roles.

Note: This does not affect the ability to map a user's title and department as roles in Process Manager. That functionality remains fully supported.

Attribute removal / clearing values

When a value changes to empty or null, Entra ID may skip sending the attribute. For example, if jobTitle changes from Value 1 to empty or null, Entra ID may skip sending the attribute rather than sending a SCIM PATCH remove operation. As a result, Process Manager may retain the previously set value.

Normal value changes sync correctly. For example, changing jobTitle from Value 1 to Value 2 results in a SCIM PATCH update as expected.