Setting up SCIM provisioning

Last updated: October 14, 2026

Who can use this feature

  • Supported on certain tiers of Enterprise plans. Contact your CSM if you don't have access.

  • Anyone with an org admin or IT admin role can access and EDIT SCIM settings

In this article, we'll show you how to set up SCIM, so you can provision new users to WRITER automatically. If you're looking for information about setting up single sign-on authentication, check out our article, Setting up SAML/OIDC SSO.

What provisioning features are supported?

WRITER supports the following provisioning features:

  • User and Group push: We support user and group push from your IdP as a way to assign users and groups directly to different team/access role combinations in WRITER.

  • Provision and Deprovision users: We support the ability to provision and deprovision users from your IdP automatically.

  • The ability to deactivate/reactivate users, or soft delete/undelete

  • Seat type assignment: We support assigning Pro or Lite seat types to users provisioned through SCIM, either through IdP group mappings or domain defaults.

WRITER doesn't support the following provisioning features:

  • Sync password

  • Create/delete teams

Reactivation: When a previously removed member is reactivated via SCIM (active=true), Writer re-reads their IdP group memberships and reapplies the seat type rule. This means a reactivated user's seat type may differ from what they had before deactivation if their group mappings have changed.

Configuring SCIM provisioning

Set up SSO from WRITER to your IdP

Before you provision SCIM, you'll need to set up the connection between WRITER and your IdP. Check out our article, Setting up SAML/OIDC SSO.

Navigate to AI Studio > Admin settings > Access & provisioning and select the SCIM tab. Select Set up SCIM to get started.

If you have not done so already, you will be prompted to claim your email domain. To learn more about claiming a domain, see our article here.

Share information from WRITER with your identity provider

To get started, go to AI Studio > Admin settings > Access & provisioning > SCIM and select Set up Directory Sync.

WRITER actively supports SCIM with multiple providers specified on this page. However, you can also set up SCIM with other identity providers as well via the Custom SCIM selection.

Select your IdP of choice, then scroll down to complete the connection. See list of available services here.

You'll be presented with service specific instructions that take you through the setup process step by step.

Share information from your IdP with WRITER

Go to the WRITER SSO application in your IdP, and enable SCIM provisioning with your WRITER setup details. This process looks different in each IdP; some guides for our most common IdPs are below:

Editing users manually

If you want users who have been synced via SCIM to have their role, team, or password access levels be editable, turn the toggle on.

If you want users who have been synced via SCIM to have their role, team, or password access to be locked, turn the toggle off.

Mapping IdP groups

file-XqxHypx2kF.png

You can map IdP groups to different teams/roles in WRITER. Once groups have been synced from the IdP, the IdP groups tab will show the IdP groups that you can map to specific teams within WRITER. These IdP groups will override any permissions set elsewhere (e.g. override default teams set up during when claiming a domain).

Managing IdP group mapping

If you’d like to set up or change your IdP groups at any time, then you can return to Admin > Access & Provisioning and select the IdP Groups tab. Select Edit to update your mapping.

From here you can also select the role in WRITER you’d like each group to have. If this is left blank, users will be assigned to the default role/team set up during domain claiming. Don’t forget to select Save when you're done editing!

Assigning seat types to IdP groups

In addition to mapping teams and roles, you can assign a seat type — Pro or Lite — to each IdP group. This determines whether users provisioned through that group receive a Pro or Lite seat.

To assign a seat type:

  1. Navigate to AI Studio > Admin settings > Access & provisioning > IdP groups.

  2. Select the group you want to configure.

  3. In the Seat type column, choose Pro or Lite.

  4. Save your changes.

How seat type is determined ("Pro wins"):

  • If a user belongs to any group mapped to Pro, they receive a Pro seat.

  • If all of a user's groups are mapped to Lite, they receive a Lite seat.

  • If a user has no group memberships, the organization domain's default seat type is used (defaults to Pro).

Switching a group from Pro to Lite:

When you switch a group from Pro to Lite, a confirmation dialog appears explaining that existing users in that group will be downgraded to Lite and their org roles will be removed. Team roles are narrowed to Lite-safe roles (Team member or Limited team member). Confirm to proceed.

Note: For users provisioned via SCIM, your IdP is the source of truth. Seat type and role changes should be managed in your IdP. Manual changes in the Writer UI will be overwritten on the next sync.

Pro seat overages

Pro seat overages allow your organization to continue provisioning users as Pro even after you've reached your contracted Pro seat count. Eligibility for overages is determined by your contract terms and is enabled by default.

What happens when Pro seats are full

How the user arrives

Overages ON

Overages OFF

New user pushed through a Pro group

Pro seat, with the group's team and org role

Lite seat, Team member on the mapped team, no org role

Lite user added to a Pro group

Becomes Pro, with that group's team and org role

Stays Lite, Team member on the mapped team

Removed from a Pro group

No change — stays Pro

Back to Lite, Team member on the claimed-domain team

Assigned directly on a Pro domain

Pro seat on that domain's team

Lite seat, Team member on that domain's team

SSO note: When users sign in via SSO and Pro seats are full, the same rule applies: Pro if overages are on, Lite if overages are off and Lite is enabled, and a failed sign-in if Lite is not available.

When a user is auto-downgraded to Lite, their org-scoped roles are automatically removed and team roles are narrowed to Lite-safe roles (Team member or Limited team member).

FAQs

General

Can we provision our entire organization?

Yes and no. IdPs typically don't allow you to select everyone  for a group push. However, if all of your users are assigned to groups, you can push all of these to WRITER, which will provision everyone.

Can we manage imported group memberships in our IdP?

No.

Can we create or delete WRITER Teams in our IdP?

No.

How are roles, hierarchy, and permissioning handled?

User added via

Default Team/Role

Role override logic

Seat type behavior

SAML/OIDC SSO

• Default role and team is mandatory - as specified in “default team”, at least 1 team must be selected • Default role can be member or team admin on whichever team(s) are specified • There is only one default role/team setting per WRITER org.

• Users added via SAML can be manually edited to be changed to a different team/role • Users added via SAML will remain in their default team and role as a member unless manually overridden or overridden by SCIM • If a user that was added via SAML is later added to IdP and synced via SCIM, their default teams will change to whatever SCIM specifies (SCIM will override)

Follows domain default seat type. Pro if overages on; Lite if Pro is full, overages off.

SCIM

• Default role and team is mandatory and is the same as the SAML default role/team for any WRITER org.

• Any users synced via SCIM are initially added to the default role/team combos set in Domain access • Manual override toggle logic is the same as for IdP groups below.

Determined by IdP group seat type mapping ("Pro wins" rule). Falls back to domain default if no groups. Auto-downgrades to Lite if Pro is full and overages are off.

IdP Groups

• Role and teams are specified per IdP Group

• Any users synced via IdP groups will be added to the role/team combo specified in IdP Groups. These role/team combos will replace the default role/team combos - if a user is in an IdP group, they will only be added to that role/team combo and not the default role/teams. • If a user is in multiple IdP groups, we will add them to all the specified team/roles ◦ If there is a conflict (eg a user is in two different IdP groups mapping to the same team but with different roles), the higher level role will override (Org Admin > Team Admin > Member) • Manual override toggle: ◦ If the toggle is set to OFF (default), users who are in SCIM IdP groups will be locked for changes in the WRITER app. ◦ If the toggle is set to ON, users who are in SCIM IdP groups will be editable manually in the WRITER app. For those edits, the users will have baseline the role / team combos specified in IdP groups. However, they can also be added to other teams outside of the IdP group mapping. If there is a conflict, the IdP groups will override.

Seat type is set per group (Pro or Lite). "Pro wins" across a user's union of groups.

Manual Invite (via People > Add people)

• At least 1 team and role must be selected • Users can be added as either a team admin or a member but not both • Users can be added for several teams for their role

• If a user that is manually added is also managed by SCIM, SCIM will override manual permissions

Admin selects Pro or Lite at invite time. If Pro is full and overages are off, falls back to Lite with a confirmation dialog.

What services are available through WorkOS?

  1. ADP OpenID Connect

  2. AWS Cognito

  3. Access People HR

  4. Apple

  5. Auth0

  6. BambooHR

  7. Breathe HR

  8. CAS SAML

  9. Cezanne HR

  10. ClassLink

  11. Clever OIDC

  12. Cloudflare

  13. CyberArk SAML

  14. CyberArk SCIM

  15. Duo

  16. Entra ID OIDC (formerly Azure AD)

  17. Entra ID SAML (formerly Azure AD)

  18. Entra ID SCIM (formerly Azure AD)

  19. Firebase

  20. Fourth

  21. GitHub OAuth

  22. GitLab OAuth

  23. Google Analytics

  24. Google Directory Sync

  25. Google OAuth

  26. Google OIDC

  27. Google SAML

  28. HiBob

  29. Intuit OAuth

  30. JumpCloud SAML

  31. JumpCloud SCIM

  32. Keycloak

  33. LastPass

  34. LinkedIn OAuth

  35. Login.gov OpenID Connect

  36. Microsoft AD FS SAML

  37. Microsoft OAuth

  38. NetIQ

  39. NextAuth.js

  40. Okta OIDC

  41. Okta SAML

  42. Okta SCIM

  43. OneLogin SAML

  44. OneLogin SCIM

  45. OpenID Connect

  46. Oracle SAML

  47. PingFederate SAML

  48. PingFederate SCIM

  49. PingOne SAML

  50. React Native Expo

  51. Rippling SAML

  52. Rippling SCIM

  53. SAML

  54. SCIM

  55. SFTP

  56. SailPoint SCIM

  57. Salesforce OAuth

  58. Salesforce SAML

  59. Segment

  60. Shibboleth Generic SAML

  61. Shibboleth Unsolicited SAML

  62. SimpleSAMLphp

  63. Slack OAuth

  64. Stripe

  65. Supabase + AuthKit

  66. Supabase + WorkOS SSO

  67. VMware

  68. Vercel OAuth

  69. Workday

  70. Xero OAuth

  71. miniOrange

Troubleshooting

If you have questions around our SCIM integration, please contact support@writer.com.