SCIM provisioning: automatically sync users and groups

How to automatically create, update, and deactivate Fyxer users — and create teams from your groups — from your identity provider using SCIM 2.0.

With SCIM, your identity provider (IdP) manages your Fyxer users for you. When someone joins or leaves in your IdP (for example Okta, Microsoft Entra ID, or OneLogin), Fyxer is updated automatically — no manual inviting or removing.

SCIM is an Enterprise plan feature and is set up with help from the Fyxer team. We recommend setting up single sign-on (SSO) first.

What SCIM does

Provisioning — creates Fyxer accounts for active users assigned to the Fyxer app in your IdP.
Updates — keeps each user's name and profile photo in sync.
Deprovisioning — removes a user and frees their seat when they're unassigned or deactivated in your IdP.
Teams from groups — creates a matching Fyxer team for each IdP group you assign to Fyxer, and keeps the team's name in sync.

What Fyxer gives you

To connect SCIM, Fyxer provides two values for your IdP's SCIM/provisioning settings:

Field	Value
SCIM Base URL (SCIM 2.0 endpoint)	Provided by Fyxer during setup (ends in `/scim/v2`)
Bearer token (secret)	Provided by Fyxer during setup

The bearer token authenticates your IdP to Fyxer — treat it like a password. Store it securely and let us know if it's ever exposed so we can rotate it.

How to set it up

Ask the Fyxer team to enable SCIM for your organization (via your account manager or the chat in the bottom right of your Dashboard). We'll send you your SCIM Base URL and bearer token.
In your IdP's Fyxer application, open the Provisioning (SCIM) settings.
Enter the SCIM Base URL and bearer token.
Enable the actions you want: create users, update users, and deactivate users.
Assign users (and groups) to the Fyxer app to provision them.

The exact menu names vary by provider — in Okta it's the app's "Provisioning" tab, and in Microsoft Entra ID it's "Provisioning" with "Tenant URL" (the SCIM Base URL) and "Secret Token" (the bearer token).

Groups and teams

Each IdP group you assign to Fyxer is created as a Fyxer team (teams unlock shared scheduling and shared recordings). Renaming the group renames the team, and removing the group removes the team.

SCIM keeps your set of teams in sync, but it does not currently sync team membership — which users belong to which team. If you need to change team membership for a SCIM-managed organization, contact your Fyxer representative.

Attribute mapping

Most IdPs let you customize how their user and group fields map to Fyxer. Fyxer expects the standard SCIM 2.0 core attributes below.

User attributes (your IdP → Fyxer)

SCIM attribute	Required	Maps to in Fyxer	Notes
`userName`	Yes	User's email address	Must be the user's email — it's the unique identifier for the account. Fixed at provisioning (changing it later in your IdP won't change the Fyxer email).
`displayName`, or `name.formatted`, or `name.givenName` + `name.familyName`	No	Display name	Fyxer uses the first of these that's present, in that order.
`active`	Yes	Account status	Must be `true` to provision. Setting it to `false` removes the user and frees their seat.
`externalId`	Recommended	Internal SCIM link	Lets Fyxer reliably match the IdP user to their Fyxer account.
`photos`	No	Profile photo	The primary photo is used (otherwise the first one).

Group attributes (your IdP → Fyxer)

SCIM attribute	Required	Maps to in Fyxer	Notes
`displayName`	Yes	Team name	Creates, renames, or deletes the matching Fyxer team.
`members`	—	Not synced	Team membership isn't currently driven by SCIM (see above).

Supported capabilities

Authentication: OAuth bearer token (the token Fyxer gives you). HTTP Basic is also provided.
Filtering: supported on userName (and emails.value) using eq, up to 200 results.
Bulk operations and PATCH are supported; sort, password change, and ETag are not.
Resource types: User and Group.

Things to know

Re-adding a removed user. Deprovisioning removes the user. To bring them back, re-assign them in your IdP so they're provisioned again - Fyxer doesn't reactivate a previously removed account in place.
Team management is restricted for SCIM organizations. Once an organization is SCIM-managed, team controls in the Fyxer Dashboard are limited. Reach out to Fyxer if you need to adjust teams or their membership.
SSO + SCIM work best together. SSO handles sign-in; SCIM handles who exists. Most enterprises use both.