SCIM

In larger companies, every person works with many programs at the same time: email, chat, calendar, accounting, video conferencing. Each of these programs requires its own user account. Someone starting a new job would have to receive these accounts individually by hand, and someone resigning would have to lose them individually again. SCIM is an agreed-upon language with which programs tell each other which people exist and what has changed about them. The abbreviation stands for “System for Cross-domain Identity Management,” meaning roughly: managing personal data across system boundaries. A central directory then automatically reports every change to all connected services.

Why forgotten accounts are dangerous

The biggest problem without automation is accounts that nobody deactivates. A person leaves the company, the IT department locks the email access, but the account in the project tool remains active. Such orphaned accesses are a popular entry point for attackers. Nobody notices them because nobody feels responsible for them anymore.

On top of that comes the sheer effort involved. At a corporation with 20,000 employees and 50 programs, that amounts to a million possible account connections. Every hire, every resignation, and every department change triggers changes. This cannot be managed by hand, and manual work produces errors.

There is also a legal reason. Data protection rules require that only people who need data for their work can access it. Auditors want proof of who had which access and when. An automated process delivers this proof because every change is logged.

What gets sent back and forth between the systems

SCIM defines two things. First, a uniform data format: which fields describe a user? Provided fields include, among others, name, email address, department, supervisor, and a switch for “active” or “inactive.” Second, the standard defines how to request, create, modify, and delete this data.

Technically, this runs via ordinary web requests, the kind a browser also sends. The central directory, for example, sends the message: “Create a user with this information.” The receiving service responds with a confirmation and its own identification number. Both sides are connected via this number from then on. If the department changes later, a short update message is enough.

A common misconception: SCIM is not the same as logging in with a company account. That login checks, at the moment someone clicks “Login,” whether the person is genuine. SCIM works beforehand and in the background. It ensures that the account exists at all and contains the correct information. In practice, both procedures are usually used together.

SCIM in enterprise software and in pricing lists

Anyone selling software for businesses can hardly avoid SCIM. Slack, Zoom, Salesforce, GitHub, and many AI tools support it. On the other side stand central directories such as Microsoft Entra ID, Okta, or Google Workspace. They hold the master data and distribute it to the individual services.

The economic aspect is interesting. Many providers only unlock SCIM in their expensive enterprise plans. The feature is considered a characteristic that large customers are willing to pay for. In the tech industry there is even a mocking name for this: the “SSO tax,” because such administrative features often multiply the price.

For private individuals, SCIM plays no role. One tends to encounter the term more in tenders, in technical data sheets, or in reports about security vulnerabilities. When a company purchases new software, SCIM support is often high up on the list of requirements.