Skip to content
Browse the docs

User Provisioning with SCIM

Let your identity provider create, update and suspend Kalima company accounts and keep teams in step with its groups through SCIM 2.0.

With SCIM, your identity provider (for example Microsoft Entra ID or Okta) creates company accounts, changes names, suspends accounts and keeps teams in step with its groups. SCIM is part of the Enterprise plan.

Open Sign-in & security, find User provisioning (SCIM) and choose Open. Owners and admins set it up.

Before you start

SCIM only creates accounts for addresses in a verified domain of your company, subdomains included. Verify your domains first. Invite people with other addresses under Members.

Set up the connection

1
Under Connection, copy the Base URL. In Microsoft Entra ID this is the tenant URL, in Okta the "SCIM connector base URL".
2
Choose Create token and copy it. Kalima shows the token only this once. In Microsoft Entra ID, enter it as the secret token; in Okta, as an HTTP header (Bearer).
3
Assign the people and groups at your identity provider and start provisioning there.
4
Check Status: last request, errors in the last 24 hours, and how many people and teams SCIM manages.

Create new token replaces the token; the previous one stops working at once. Revoke switches SCIM off: Kalima accepts no more requests from your identity provider, accounts and teams stay as they are, and you manage them in the console again.

What SCIM does in Kalima

  • New people get a company account with the member role and take a seat. Your company accepts the Terms of Service for them, and they see a notice about it when they first sign in. Without single sign-on, Kalima also sends them one email with a link to set their password.
  • Deactivating or deleting someone at the identity provider suspends the account and signs it out everywhere. The recordings stay with the company, and everyone who could open them before still can.
  • Groups become teams. Who is in such a team is decided by the identity provider.
  • Email addresses are never changed by SCIM.
  • Owners are never created, changed or suspended through SCIM.

What changes in the console

People that SCIM manages cannot be suspended or removed in the console; they are marked Managed by your identity provider. For teams from SCIM you change neither the name nor the members in the console. You still assign roles and team leads in Kalima.

When an address is refused

  • Address taken: if an address already has another Kalima account (for example a private account), Kalima refuses to create it. The existing account stays untouched. The person has to change that account's address or delete it.
  • Address outside your domains: verify the domain, or invite the person under Members.
  • No free seat: all seats are taken or held by invitations.
  • Open invitation: revoke the invitation under Members first.

Log

Log shows the last 100 requests from the past 30 days, with time, request and result. Kalima stores no request contents, no names and no tokens.

Single sign-on (SSO)
Let the same people sign in through your identity provider.
Domains
Verify the domains SCIM may create accounts for.
Teams
Teams from SCIM groups and team leads.