# SCIM 2.0 Source: https://startwithidentity.com/standards/scim-2-0/ Last updated: 2026-10-17 License: content by Start with Identity. Cite the source URL. --- ## What it is SCIM (System for Cross-domain Identity Management) is an open standard, defined by IETF RFC 7643 (the schema) and RFC 7644 (the protocol), for automating the user and group lifecycle across applications. When HR hires someone or an admin grants an app, SCIM pushes that change so accounts are created, updated, and, most importantly, removed without manual work. Two later RFCs update both documents: [RFC 9865](https://datatracker.ietf.org/doc/rfc9865/) (October 2025) adds cursor-based pagination, and [RFC 9967](https://datatracker.ietf.org/doc/rfc9967/) (May 2026) adds a SCIM profile for security event tokens. It answers a different question from [SAML](https://startwithidentity.com/standards/saml-2-0/) and [OIDC](https://startwithidentity.com/standards/openid-connect/). Those authenticate a person at login. SCIM makes sure the account exists, carries the right attributes, and disappears when they leave. Most enterprise deployments need both, which is why procurement checklists ask for them together. ## How it works SCIM defines a standard JSON representation of users and groups and a REST API to manage them. An identity provider acts as the client and pushes changes to any application that exposes a SCIM endpoint. - **Standard schema:** common attributes for users and groups, extensible per app. - **REST operations:** create, read, update, delete, and search over `/Users` and `/Groups`. - **Discovery endpoints:** `/ServiceProviderConfig`, `/ResourceTypes` and `/Schemas` declare what the server actually supports. - **Filtering:** query by attribute, for example `userName eq "ada@example.com"`, so clients can look before they create. The discovery endpoints are the most commonly skipped part of the specification, and skipping them is the most common cause of avoidable failures. A client that reads `/ServiceProviderConfig` before assuming `PATCH` is available fails less often than one that does not. ## Where implementations actually break The specification is clearer than its reputation. Deployments break because implementations are partial, and in a consistent set of places. **PATCH semantics for multi-valued attributes.** Group membership is the usual casualty. Some implementations do not support `PATCH` at all; others differ on whether a patch to a multi-valued attribute replaces or appends. The visible symptom is that additions work and removals silently do not, which is the worst possible failure mode for deprovisioning. **Inconsistent filtering.** If filtering is unreliable, a client cannot confirm whether a user already exists before creating one, and duplicates follow. **Soft delete versus hard delete.** RFC 7644 does not mandate which happens on `DELETE`. Applications vary. That distinction decides whether a licence is reclaimed and whether an auditor sees the account as removed, so confirm it per application rather than assuming. **Custom schema extensions.** Vendors extend the schema differently. A working integration against one application predicts very little about the next. ## Status The RFCs were finalised in 2015 and SCIM 2.0 remains current. There is no SCIM 3.0; IETF work continues on extensions and profiles rather than a new major version. That stability is an advantage: an integration written years ago still works. ## Why it matters Deprovisioning is the part of the identity lifecycle most often handled badly by hand, and orphaned accounts are both a standing audit finding and a real attack path. Automating removal is usually the business case, ahead of the convenience of automated creation. For anyone selling B2B software, SCIM has become a gate. Enterprise security reviews routinely require both SSO and automated provisioning before purchase, which is why a market exists specifically for adding them quickly. See our [SCIM provisioning tools](https://startwithidentity.com/articles/top-7-scim-provisioning-tools/) comparison for the options. ## Related [SAML 2.0](https://startwithidentity.com/standards/saml-2-0/), [OpenID Connect](https://startwithidentity.com/standards/openid-connect/), and the [SCIM glossary entry](https://startwithidentity.com/glossary/scim/). For identity governance built on top of provisioning, see [what is IGA](https://startwithidentity.com/guides/fundamentals/what-is-iga/). ## Who wrote it The SCIM protocol, RFC 7644, was edited by [Phil Hunt](https://startwithidentity.com/experts/phil-hunt/) with co-authors from SailPoint, Cisco, Nexus, and Salesforce. More in the [experts directory](https://startwithidentity.com/experts/).