Set Up SCIM User Provisioning in Demandbase

System for Cross-domain Identity Management (SCIM) user provisioning lets administrators automate user management for Demandbase One using an identity provider, such as Okta or Microsoft Entra ID.

When users are assigned, updated, unassigned, or deleted in your identity provider, Demandbase automatically creates, updates, or de-provisions the corresponding users.

SCIM provisioning reduces manual user management, keeps user information consistent across systems, and helps maintain security by removing access when users no longer need it.

Benefits of SCIM User Provisioning in Demandbase

• Automated user management: Create, update, and de-provision Demandbase users based on changes in your identity provider.
• Consistent user information: Synchronize user attributes, including names and email addresses.
• Role-based access: Automatically assign Demandbase roles based on SCIM group membership.
• Improved security: Remove user access when users are unassigned or deleted in your identity provider.
• Provisioning visibility: Review the change history for automatically provisioned users.

How SCIM User Provisioning Works in Demandbase

SCIM user provisioning uses SCIM APIs to synchronize user changes from your identity provider to Demandbase.

When SCIM provisioning is enabled, Demandbase supports the following actions:

Important: SCIM provisioning does not run on a scheduled job in Demandbase. Instead, your identity provider sends SCIM API requests to Demandbase when user changes need to be synchronized. The timing and frequency of these requests depend on your identity provider's configuration.

Understanding SCIM Group-to-Role Mappings

SCIM group-to-role mappings determine which Demandbase role a user receives based on group membership in your identity provider.

When a user is provisioned, Demandbase checks the user's SCIM group membership and assigns the role configured in the matching provisioning workflow.

Important: If a provisioned user's group does not match any configured Demandbase role mapping, Demandbase rejects the provisioning request and returns an error. Contact Demandbase Support for assistance.

Prerequisites to Set Up SCIM User Provisioning in Demandbase

• You must have admin access in Demandbase.
• You must have admin access in your identity provider, such as Okta or Microsoft Entra ID.
• You must generate API credentials in Demandbase. See Set Up SCIM API Authentication in Demandbase.
• You must configure SCIM in your identity provider. See Set Up SCIM API Authentication in Demandbase.

Set Up SCIM User Provisioning in Demandbase

Create a SCIM provisioning workflow to assign Demandbase roles based on SCIM group membership.

Important: You must have at least one enabled provisioning workflow with Any SCIM Group selected. This workflow acts as the default for users who don't match a specific SCIM group. Place the Any SCIM Group workflow after group-specific workflows to ensure users receive the appropriate Demandbase roles.

1. From the left navigation bar, go to Settings > User Management > User Onboarding.
2. Under SCIM Provisioning, click Create.
3. Enter the following:
   • Name: Name of SCIM provisioning workflow.
   • And SCIM Group is:
     1. Any SCIM Group: Applies the workflow to users in any SCIM group
     2. Any of the following SCIM Groups: Applies the workflow to users in the selected SCIM groups. Select the applicable groups from the SCIM Groups drop-down.
   • Then provision user with Role: Select the Demandbase role to assign to users who match the workflow's SCIM group criteria.
     Important: If a user belongs to multiple SCIM groups that match different provisioning workflows, Demandbase assigns the role from the first matching workflow. Administrators can reorder workflows to determine which role takes precedence. See Reorder SCIM Provisioning Workflows in Demandbase.
4. Toggle on Workflow enabled.
5. Click Save.

Reorder SCIM Provisioning Workflows in Demandbase

Reorder SCIM provisioning workflows to control which Demandbase role is assigned when a user matches multiple workflows. Demandbase evaluates workflows in the configured order and applies the first matching workflow.

1. From the left navigation bar, go to Settings > User Management > User Onboarding.
2. Under SCIM Provisioning, drag and drop the workflows into the desired order.

Important: Configure the workflow order before provisioning users to ensure the correct Demandbase roles are assigned.

Manage SCIM-Provisioned User Settings

After Demandbase creates a user through SCIM provisioning, administrators can manually update the user's settings to manage individual access.

See Create and Manage Users.

View SCIM User Provisioning History

Use the Provisioning History tab to review users imported into Demandbase through SCIM.

1. From the left navigation bar, go to  Settings > User Management > Change History.
2. Click the Provisioning History tab to view users provisioned through SCIM.
   

Delete SCIM User Provisioning in Demandbase

Delete a SCIM provisioning workflow when you no longer need its group-to-role mapping.

Important: : Deleting a SCIM provisioning workflow does not delete existing users. Users are de-provisioned when they are unassigned from the Demandbase application or deleted in your identity provider. De-provisioning does not depend on the workflow configuration.

1. From the left navigation bar, go to Settings > User Management > User Onboarding.
2. Under SCIM Provisioning, find the workflow you want to delete.
3. Click the settings icon.
4. Click Delete.
5. In the confirmation pop-up, click Save.

Next Steps after Setting Up SCIM User Provisioning

After configuring SCIM provisioning workflows in Demandbase, assign users or groups to the Demandbase application in your identity provider to begin provisioning.

Demandbase automatically:

• Creates, updates, or de-provisions users based on changes in your identity provider.
• Assigns Demandbase roles based on SCIM group mappings and the first matching enabled provisioning workflow.