Setting up SCIM provisioning

In this article, we'll show you how to set up SCIM, so you can provision new users to Writer automatically. If you're looking for information about setting up single sign-on authentication, check out our article, Setting up SAML SSO.

What's in this article:

• What provisioning features are supported?
• Configuring SCIM provisioning
  • Set up SAML SSO between Writer and your IdP
  • Share information from Writer to your IdP
  • Choose default team in Writer
• Troubleshooting
• Frequently asked questions

What provisioning features are supported?

Writer supports the following provisioning features:

• User and Group Push: IdP groups are automatically pushed to Writer Teams, and users are pushed as team members in your Writer organization.
• User and Group Import: Writer users are imported into IdP and matched against existing users, or created as new ones. Writer Teams are imported as IdP groups.
• Update user attributes
• Provision/deprovision users

Writer does not support the following provisioning features, but may in the future:

• Sync password
• Create/delete teams
• Deactivate/reactivate users

Configuring SCIM provisioning

Set up SAML SSO from Writer to your IdP

Before you provision SCIM, you'll need to set up the connection between Writer and your IdP. Check out our article, Setting up SAML SSO.

Share information from Writer with your identity provider

To get started, visit Admin > Single sign-on page and scroll down to the section named SCIM. Select Set up SCIM.

You'll be presented with 3 important fields, which you'll share with your identity provider in the next step.

Unique identifier:

email

Endpoint:

https://app.writer.com/api/scim/v2

Bearer token:

unique to your organization

Share information from your IdP with Writer

Go to the Writer SSO application in your IdP, and enable SCIM provisioning with your Writer setup details:

• Setting up Entra SCIM
• Setting up Okta SCIM
• Setting up PingOne SCIM

Choose default team in Writer

Once SCIM provisioning is set up in your IdP, return to Admin > Single sign-on in Writer.

Under Default user permissions, select a team from the dropdown menu.

This decides which team to add new users to when they've been created via SCIM. (This does not interfere with pushes from specific IdP groups to Writer teams.) You can also edit or remove the configuration, if needed.

Frequently asked questions

General

Q: Can we provision our entire organization?

Yes and no. IdPs typically don't allow you to select everyone for a group push. However, if all of your users are assigned to groups, you can push all of these to Writer, which will provision everyone.

Q: Can we manage imported group memberships in our IdP?

No.

Q: Can we create or delete Writer Teams in our IdP?

No.

Q: Can we set the team admin user role in our IdP?

No.

Troubleshooting

If you have questions around our SCIM integration, please contact support@writer.com.