BuildBetter supports SCIM 2.0 (System for Cross-domain Identity Management) for automated user lifecycle management. SCIM enables your identity provider to automatically create, update, and deactivate user accounts in BuildBetter.Documentation Index
Fetch the complete documentation index at: https://docs.buildbetter.ai/llms.txt
Use this file to discover all available pages before exploring further.
SCIM provisioning is available for Enterprise customers with custom SAML SSO integrations. Contact your account representative to enable SCIM for your organization.
Overview
SCIM automates the user provisioning process, ensuring that:- New employees automatically get BuildBetter access when added to your identity provider
- Departing employees are immediately deprovisioned when removed from your identity provider
- User profile changes (name, email) are synced automatically
- Account management is centralized in your identity provider
Automatic Provisioning
New users are created in BuildBetter when assigned in your IdP
Automatic Deprovisioning
Users are deactivated when unassigned or removed from your IdP
Profile Sync
User profile updates are synchronized automatically
Centralized Control
Manage all access from your identity provider
Supported Identity Providers
BuildBetter’s SCIM implementation works with any SCIM 2.0 compliant identity provider, including:- Okta
- Azure Active Directory (Entra ID)
- OneLogin
- JumpCloud
- Google Workspace (with SCIM connector)
- Ping Identity
SCIM Capabilities
Supported Operations
| Operation | Description | Supported |
|---|---|---|
| Create User | Provision new users in BuildBetter | Yes |
| Update User | Modify user profile attributes | Yes |
| Deactivate User | Disable user access without deletion | Yes |
| Delete User | Remove user from BuildBetter | Yes |
| Get User | Retrieve user information | Yes |
| List Users | Retrieve all provisioned users | Yes |
Supported Attributes
BuildBetter supports the following SCIM user attributes:| SCIM Attribute | BuildBetter Field | Required |
|---|---|---|
userName | Email address (primary identifier) | Yes |
name.givenName | First name | Yes |
name.familyName | Last name | Yes |
active | Account status | Yes |
emails[primary] | Primary email | Yes |
displayName | Display name | No |
Role-based access control (RBAC) and department assignments are managed within BuildBetter’s admin settings rather than through SCIM. This allows for flexible permission configurations that may not map directly to your IdP’s group structure.
Setting Up SCIM with Okta
Follow these steps to configure SCIM provisioning with Okta:Request SCIM Configuration
Contact BuildBetter support at support@buildbetter.ai to request SCIM provisioning setup. We’ll provide you with:
- SCIM Base URL
- API Bearer Token for authentication
- Any organization-specific configuration details
Create SCIM Application in Okta
- Log in to your Okta Admin Console
- Navigate to Applications > Applications
- Click Create App Integration
- Select SAML 2.0 (if you haven’t already configured SAML SSO)
- Or select your existing BuildBetter SAML application
Configure Provisioning
- In your BuildBetter application, go to the Provisioning tab
- Click Configure API Integration
- Check Enable API Integration
- Enter the SCIM Base URL provided by BuildBetter:
- Enter the API Token (Bearer Token) provided by BuildBetter
- Click Test API Credentials to verify the connection
- Click Save
Enable Provisioning Features
After saving the API configuration:
- Go to Provisioning > To App
- Click Edit
- Enable the following options:
- Create Users - Provision new users
- Update User Attributes - Sync profile changes
- Deactivate Users - Disable access when unassigned
- Click Save
Configure Attribute Mappings
- Go to Provisioning > To App > Attribute Mappings
- Verify the following mappings are configured:
| Okta Attribute | BuildBetter Attribute |
|---|---|
user.email | userName |
user.firstName | name.givenName |
user.lastName | name.familyName |
user.email | emails[primary].value |
- Click Save after making any changes
Setting Up SCIM with Azure AD (Entra ID)
Request SCIM Configuration
Contact support@buildbetter.ai to receive your SCIM credentials.
Configure Enterprise Application
- Log in to the Azure Portal
- Navigate to Azure Active Directory > Enterprise Applications
- Select your existing BuildBetter application or create a new one
- Go to Provisioning in the left menu
- Set Provisioning Mode to Automatic
Enter Admin Credentials
In the Admin Credentials section:
- Tenant URL: Enter the SCIM Base URL from BuildBetter
- Secret Token: Enter the API Bearer Token from BuildBetter
Configure Mappings
- Expand Mappings
- Select Provision Azure Active Directory Users
- Verify the attribute mappings match your requirements
- Enable the mapping and save
User Lifecycle Management
When a User is Assigned
When you assign a user to BuildBetter in your identity provider:- The IdP sends a SCIM create request to BuildBetter
- BuildBetter creates the user account with the provided attributes
- The user receives a welcome email (if enabled)
- The user can sign in via SSO immediately
When a User is Updated
When you update a user’s profile in your identity provider:- The IdP sends a SCIM patch request to BuildBetter
- BuildBetter updates the user’s profile with the new attributes
- Changes take effect immediately
When a User is Unassigned or Deactivated
When you remove a user’s access in your identity provider:- The IdP sends a SCIM deactivate request to BuildBetter
- BuildBetter deactivates the user account
- The user can no longer sign in
- User’s data is retained according to your data retention policy
Deactivated users’ data remains accessible to administrators for compliance and audit purposes. If you need to permanently delete user data, contact support@buildbetter.ai.
Troubleshooting
Users not being provisioned
Users not being provisioned
Common causes:
- API credentials are incorrect or expired
- User is not assigned to the application in your IdP
- Required attributes (email, first name, last name) are missing
- Test the API connection in your IdP’s provisioning settings
- Verify the user is assigned to the BuildBetter application
- Check that all required user attributes are populated
- Review provisioning logs in your IdP for specific error messages
Profile changes not syncing
Profile changes not syncing
Common causes:
- Attribute mappings are misconfigured
- Provisioning is paused or disabled
- Rate limiting on API requests
- Verify attribute mappings in your IdP
- Ensure provisioning is enabled and running
- Trigger a manual sync if available
- Wait a few minutes and check again (some IdPs batch updates)
Users not being deprovisioned
Users not being deprovisioned
Common causes:
- Deactivation is not enabled in provisioning settings
- User was removed from IdP but not unassigned from the app
- Verify “Deactivate Users” is enabled in provisioning settings
- Ensure the user was properly unassigned from the application
- Check provisioning logs for any errors
- Contact BuildBetter support if the issue persists
API connection test failing
API connection test failing
Common causes:
- Incorrect SCIM Base URL
- Invalid or expired API token
- Network/firewall blocking the connection
- Verify the SCIM Base URL is exactly:
https://api.buildbetter.ai/scim/v2 - Request a new API token from BuildBetter support
- Ensure your network allows outbound HTTPS connections to BuildBetter
Security Considerations
Authentication
- SCIM requests are authenticated using Bearer tokens
- Tokens are organization-specific and can be rotated on request
- All SCIM traffic is encrypted via TLS 1.2+
Audit Logging
All SCIM operations are logged for compliance purposes:- User creation events
- Profile updates
- Deactivation events
- API authentication attempts
Data Protection
- SCIM data is transmitted over encrypted connections only
- User data is stored according to BuildBetter’s data security policies
- Deactivated users can be permanently deleted upon request
Frequently Asked Questions
Can I use SCIM without SSO?
Can I use SCIM without SSO?
SCIM provisioning is typically paired with SAML SSO for a complete identity management solution. Contact your account representative to discuss your specific requirements.
Are groups/roles supported via SCIM?
Are groups/roles supported via SCIM?
Currently, BuildBetter manages roles and permissions within the application rather than through SCIM group provisioning. This provides flexibility for complex permission structures that may not map directly to your IdP’s group hierarchy.
How quickly are changes synced?
How quickly are changes synced?
Most identity providers sync changes within minutes. The exact timing depends on your IdP’s provisioning schedule and configuration.
Can I provision users to multiple workspaces?
Can I provision users to multiple workspaces?
Yes. Contact BuildBetter support to configure multi-workspace provisioning based on your organizational structure.
What happens to existing users when I enable SCIM?
What happens to existing users when I enable SCIM?
Existing users can be linked to your IdP through email matching. Contact BuildBetter support to coordinate the initial sync and avoid duplicate accounts.
For assistance with SCIM configuration or to request SCIM provisioning for your organization, contact support@buildbetter.ai or your account representative.