> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.alephant.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.alephant.io/_mcp/server.

# SCIM / User Group Sync

> Sync users and groups from an enterprise identity system while keeping permission lifecycle changes auditable.

SCIM / user group sync brings users and groups from an enterprise identity system into AIvis. It is intended for enterprise deployments that need centralized identity governance and lower manual user-management risk.

## Management Boundary

| Area               | Guidance                                                                                 |
| ------------------ | ---------------------------------------------------------------------------------------- |
| Identity Source    | Connect only approved identity providers or directory systems.                           |
| Sync Scope         | Define which users, groups, and attributes sync instead of importing without boundaries. |
| Permission Mapping | Map synced identities into AIvis roles, groups, and resource sharing scopes.             |
| Audit              | Record token creation, sync results, failure reasons, and abnormal changes.              |

## Before Configuration

* Confirm the deployment has enterprise capabilities enabled and the administrator has SCIM configuration access.
* Define the users, groups, attributes, and deactivation policy in the identity provider.
* Store SCIM tokens in protected identity-provider configuration, not in docs, chats, or tickets.

## Verification

* Run a sync with a test user and test group.
* Validate create, deactivate, and group-removal lifecycle events in AIvis.
* Confirm regular users cannot view or modify SCIM configuration.