SCIM provisioning

Spend is a SCIM 2.0 service provider at https://<host>/api/scim/v2.

Connect a directory

1. An administrator issues a token on Administration › Sign-in and provisioning. It is shown once.
2. In the directory’s provisioning settings, enter the tenant URL and the token (bearer authentication).

What is supported

• Users and Groups, including PATCH.
• Filters on userName, externalId and displayName.
• The enterprise extension’s department and employeeNumber.

A person the directory sends is linked to an existing Spend user with the same email, or created with no roles. Removing or deactivating them in the directory deactivates them in Spend; their history stays on the audit trail.

Groups and roles

On the same page, administrators map directory groups to Spend roles. Once a map is saved, a directory-managed person’s roles are exactly what their groups grant:

• Removing a group’s roles, or the last mapping, takes those roles away.
• Renaming a group in the directory re-decides everyone in it.
• A membership change that would combine conflicting duties (entering and approving invoices, for example) is refused with a SCIM 400 and logged, and the person keeps the roles they had.

Every provisioning change is a security event on the SIEM feed.