SCIM provisioning

SCIM (System for Cross-domain Identity Management) lets your Identity Provider (IdP) push user and group changes to CARTO as they happen. Your IdP notifies CARTO directly, so joiners, leavers and group moves are reflected in your organization without waiting for the affected users to log in.

SCIM provisioning is only available for Enterprise Large plans and above, and requires an existing SSO integration. Please get in touch at [e-mail] if you're interested in this feature.

Why SCIM

Without SCIM, CARTO reads a user's group membership from your IdP each time that user logs in, so changes only land when the affected user next signs in. Someone moved into a new group keeps their old access until their next login, and someone removed from a group keeps that group's access until then too.

Pushing changes instead matters most for:

• Offboarding. Access is revoked when the user is unassigned in your IdP, not at their next login attempt.

• Role changes. When you use group role mapping, a move between groups applies the new role right away.

• Onboarding. Users and groups exist in CARTO before their first login, so you can share maps and assign roles ahead of time.

• Audit. The Users & Groups settings reflect your IdP at all times, which makes access reviews meaningful.

What SCIM keeps in sync

Once SCIM is enabled, your IdP becomes the source of truth for users and groups in CARTO:

Change in your IdP	Result in CARTO
A user is assigned to CARTO	The user is created in CARTO with the Default role set in the Users & Groups settings (see Managing user roles), or with the role granted by their groups if you use group role mapping
A user's email address is updated	The user's email address is updated in CARTO
A user is added to or removed from a group	Their group membership is updated, along with any role that group grants
A group is created, renamed or deleted	The group is created, renamed or removed in the Groups tab of the Users & Groups settings
A user is unassigned from CARTO, or deleted in your IdP	The user is removed from your CARTO organization and can no longer log in

Setting up SCIM

Like SSO, SCIM integrations are handled by our Support Team. Get in touch at [e-mail] and mention that you want to enable SCIM provisioning, along with the IdP you use.

Our Support Team will provide two values for you to configure in your IdP:

• SCIM endpoint URL: the base URL your IdP sends provisioning requests to, unique to your organization.

• Secret token: the bearer token your IdP uses to authenticate against that endpoint.

CARTO implements the SCIM 2.0 standard, exposing the /Users and /Groups resources, so any IdP with SCIM 2.0 support can integrate with it.

Choosing which users and groups to sync

Your IdP decides what to send to CARTO, so you scope the sync there rather than in CARTO. In most providers you assign the CARTO application to the users and groups that should exist in CARTO, and only those are provisioned.

This replaces the need to pre-create groups for role mapping: groups arrive from your IdP with their members already populated, so you can assign roles to a group as soon as it appears.

If you previously set up group sync rules for SSO, review them when you enable SCIM. Groups now arrive through the provisioning configuration of your IdP application, which may be scoped differently from your old SSO group claim.