Manage members with SCIM provisioning

Slack supports member provisioning with the System for Cross-domain Identity Management (SCIM) standard. To use provisioning, you’ll need to use a connector app alongside a supported identity provider.

Tip: If you’d like to build a custom script to handle provisioning, see our SCIM API for details.

Manage members

SCIM provisioning allows workspace owners and admins to manage members more efficiently. Here’s what you can do:

• Create or deactivate a member
• Create or deactivate a multi-channel guest*
• Sync and update members' profile fields
• Create or delete a user group
• Add or remove members from a user group

*Only available on the Enterprise Grid subscription. If you’d like to create a single-channel guest, or create a guest on the Business+ subscription, you can create a member and then change their role to a guest.

Note: It’s not possible to set up unique display names for user groups with SCIM provisioning.

Set up provisioning

Your SCIM provisioning setup will vary depending on the identity provider that you use. Here are the ones that we support:

• Google Workspace (SAML)
• Microsoft Azure Active Directory
• Okta

• OneLogin
• PingFederate
• PingOne

During set up, your identity provider will ask for an API token created through the OAuth 2.0 flow.

Slack also supports live syncing of Active Directory groups for workspaces using these identity providers.

Note: Members and guests added through SCIM are billable as soon as they sign in for the first time. The cost of new accounts will be prorated for the remainder of your current billing period.

Using Slack Enterprise Grid? Learn how to connect IDP groups to workspaces on your Enterprise Grid organisation.

Who can use this feature?

• Workspace owners can turn on this feature so that Admins can manage provisioning.
• Available on the Business+ and Enterprise Grid subscriptions.