# What is System for Cross-domain Identity Management (SCIM)?

> System for Cross-domain Identity Management (SCIM) is an IETF standard for exchanging identity-resource data between systems so that accounts and groups can be created, read, updated, searched, disabled, or removed consistently.

- Canonical URL: https://yellowcube.eu/glossary/system-for-cross-domain-identity-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It provides a common JSON-based schema and an HTTP protocol, reducing the need for a different proprietary provisioning interface for every connected service.

A typical deployment connects an authoritative identity source or identity service to applications that maintain local accounts. A joiner, role change, group change, or departure triggers SCIM operations against those applications. The standard defines core User and Group resources, extension mechanisms, filtering, patching, bulk operations, and service-capability discovery, but the organization still decides which system is authoritative and which attributes may flow.

### Key points

- **Provisioning role:** Use SCIM to synchronize lifecycle state and selected attributes before, during, or after access is needed; verify that disablement and removal reach every target.
- **Trust and protection:** Authenticate and authorize SCIM clients, use protected transport, restrict them to necessary resources and attributes, and treat provisioning credentials as privileged secrets.
- **Data governance:** Map identifiers and schemas deliberately, minimize transferred attributes, define conflict handling, and record ownership, retries, failures, and reconciliation results.
- **Important limitation:** SCIM does not authenticate an end user, create a login session, or guarantee immediate deprovisioning. Failed connectors, stale source data, conflicting updates, and unsupported application behavior can leave accounts or access inconsistent.

### Related terms

[Identity and access management (IAM)](<https://yellowcube.eu/glossary/identity-and-access-management/>) · [Single sign-on (SSO)](<https://yellowcube.eu/glossary/single-sign-on/>) · [Federated identity](<https://yellowcube.eu/glossary/federated-identity/>) · [Active Directory (AD)](<https://yellowcube.eu/glossary/active-directory/>) · [Identity as a service (IDaaS)](<https://yellowcube.eu/glossary/identity-as-a-service/>)

### Sources

[RFC 7642: SCIM Definitions, Overview, Concepts, and Requirements](https://datatracker.ietf.org/doc/html/rfc7642) · [RFC 7643: SCIM Core Schema](https://datatracker.ietf.org/doc/html/rfc7643) · [RFC 7644: SCIM Protocol](https://datatracker.ietf.org/doc/html/rfc7644)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.