SCIM tokens (create, rotate and revoke)

Microsoft Entra ID and Okta create, update and remove your organization's people and groups over SCIM 2.0. They authenticate with a token you create under «Manage» › «SCIM tokens».

How do I create a token?

1. Open «Manage» › «SCIM tokens». The console explains that the service keeps only a fingerprint of each token.
2. Choose «Create token» and fill in:
   • Name (1 to 64 characters), for example "Entra production".
   • Scopes: «Users (scim:users)» and/or «Groups (scim:groups)». For Entra and Okta, pick both.
   • «Valid for»: «30 days», «90 days», «1 year» or «2 years».
3. Confirm. «New SCIM token» opens with the «Tenant URL» and the «Secret token». «The secret is only shown once.»
4. Copy both into the identity provider and choose «Done».

The URL looks like https://<organization address>/scim/v2. Each organization has at most five live tokens.

How do I rotate a token?

1. On the token's row, choose «Rotate token».
2. Choose what happens to the old one: «stops at once», «works for 1 more hour», «works for 24 more hours» (default) or «works for 7 more days».
3. Copy the new secret into the identity provider: «Token rotated. Copy the new secret into the identity provider now.»

The new token keeps the name and scopes.

How do I revoke?

«Revoke» › «Confirm revocation». Revocation is immediate.

States

«Active», «Expiring soon», «Expired», «Revoked». The «Last used» column shows whether the identity provider is using the token.

Errors the identity provider sees

See SCIM answers 401.

Creating, rotating and revoking need a recent confirmation and are recorded in the audit.