SCIM

SCIM is a REST protocol in which the customer’s identity provider creates, updates and deactivates users and groups in your application by calling endpoints you expose, such as POST /Users, PATCH /Users/{id} and /Groups. The resource schema is RFC 7643 and the protocol, including PATCH operations and filtering, is RFC 7644. Sign-in itself happens over SAML or OpenID Connect; SCIM decides whether the account exists at all.

In an FDE interview

Okta’s FDE postings, as of September 2026, put SCIM on the same identity-protocol list as SAML and OIDC. ^{[1, 2, 3]}Source 1Senior Forward Deployed Engineer - Okta for AI AgentsPublisherOkta (Greenhouse)Source typecompany job postingSource 2Principal Forward Deployed Engineer - Okta for AI AgentsPublisherOkta (Greenhouse)Source typecompany job postingSource 3Principal Forward Deployed Engineer (Singapore)PublisherOkta (Greenhouse)Source typecompany job posting It is the half of designing sign-in through a customer’s identity provider that weak answers skip: they build SAML or OIDC, sync users by email, and never handle removal. A planned practice question, Designing provisioning from the customer’s identity provider, will ask for it directly. A strong candidate keys users on the identity provider’s externalId or your own id, treats active: false as an event that revokes live sessions and API tokens immediately, not just the next sign-in, and says how directory groups map to roles in your product.

Two things break go-lives. Before creating a user, the identity provider searches with GET /Users?filter=userName eq "...": if you have not implemented the filter, or it does not return users already created by just-in-time sign-in, the provider tries to create them again, and you get duplicate accounts or 409 Conflict errors. And Okta and Microsoft Entra ID shape their PATCH requests differently, so a server tested against one can fail against the other; test against the customer’s actual identity provider before the cutover date.

The lesson Identity and network in someone else’s environment covers provisioning and de-provisioning, and a planned SCIM provisioning design prompt will be the practice.

Where it comes up

• Design user and group provisioning from the customer’s identity provider into your application, including removal. planned
• Given the list of users in an identity provider and in your app, compute the creates, updates and deactivations needed to sync them. planned
• Design how your product authenticates a large customer’s employees through their identity provider and removes access the day someone leaves.