SCIM provisioning
Automate joiners, leavers, and team membership in Dropstone from your identity provider using SCIM 2.0. Users and groups are supported. Deprovisioning is a soft delete.
SCIM lets your identity provider manage Dropstone membership for you. When someone joins your company, they get a Dropstone account. When they change teams, their Dropstone team changes. When they leave, their access is removed. None of it needs an admin to do anything in Dropstone.
SCIM is available on the Enterprise plan and works alongside SSO.
What is supported
- Users: create, read, update, and deactivate
- Groups: mapped to Dropstone teams, so directory group membership becomes team membership
Dropstone implements SCIM 2.0, so it works with any identity provider that supports the standard, including Okta and Microsoft Entra ID.
Setting it up
An organization admin enables SCIM from the organization settings in the dashboard and generates a SCIM token.
In your identity provider, create a SCIM integration for Dropstone using the base URL and token Dropstone shows you. Assign the users and groups that should have access. The identity provider then pushes changes to Dropstone as they happen.
The token is shown once. Store it in your identity provider and nowhere else. You can rotate it from the same settings page at any time; the old one stops working when you do.
Groups and teams
A group assigned through SCIM becomes a Dropstone team with the same name, and its members become the team's members. Moving someone between groups in your directory moves them between teams in Dropstone.
Teams are what shared memory is scoped to, so keeping groups accurate keeps shared memory going to the right people.
Deprovisioning
When a user is removed or deactivated in your identity provider, SCIM deactivates their Dropstone account. This is a soft delete: the account is disabled and the person can no longer sign in, but the account and its data are retained so that access can be restored if the removal was a mistake.
A deactivated member's private memory is not visible to anyone. Memories they had shared remain shared until an admin removes them; see Shared memory across a team.
To permanently delete a deactivated account's data, contact support from an owner or admin account.
SCIM and SSO together
SCIM decides who has an account and which team they are on. SSO decides how they sign in. Use both: SSO alone provisions people on first sign-in but does not know when they leave; SCIM alone creates accounts but leaves them signing in with a password.
Troubleshooting
Users are not appearing. Check that they are assigned to the Dropstone application in your identity provider, and that the SCIM integration is enabled there, not just created.
A group did not become a team. Confirm the group is pushed to Dropstone in the integration's settings. Some providers require groups to be explicitly selected for push.
"Unauthorized" from the SCIM endpoint. The token is wrong or has been rotated. Generate a new one and update the integration.