# Provision members with SCIM

Enable SCIM provisioning so your IT team can add and deactivate RandomCoffee members from your identity provider, in real time.

import { Steps } from '@prosefly/astro-components';
import Callout from '@components/Callout.astro';
import ScimPanel from '@components/app-screens/screens/ScimPanel.astro';

RandomCoffee supports SCIM (System for Cross-domain Identity Management). With SCIM, your IT team adds and removes RandomCoffee members directly from your identity provider, such as Okta, Microsoft Entra ID or OneLogin.

<Callout type="note">
  SCIM provisioning is available on the Pro and Enterprise plans.
</Callout>

## Why use SCIM provisioning

Your IT administrators manage access to RandomCoffee from a central place, your identity provider. It adds security and removes the manual work of keeping your member list up to date.

The setup is shared between you and your IT team: you enable SCIM in RandomCoffee, then your IT team connects your identity provider.

## Enable SCIM

<Steps>

1. Open the settings (gear icon), then "Configuration".
2. Click the "SCIM Provisioning" card.
3. Click "Enable".
4. Copy the values of "Copy this Base URL" and "Copy this API Token", and send them to your IT team.

   <ScimPanel alt="The SCIM Provisioning panel, with the Base URL and API Token fields and the Enable button" />

5. Your IT team sets up user provisioning in your identity provider. Point them to [SCIM provisioning](/documentation/provisioning/scim/), which describes the setup for each identity provider and how to add custom fields.

</Steps>

To stop provisioning, ask your IT team to turn off provisioning to RandomCoffee in your identity provider.

## Give your members access

Members provisioned through SCIM do not receive the welcome email.

If the [Member Portal](/admin/workspace-settings/member-portal-access/) is turned on, send them the login link: [https://app.random-coffee.com/login](https://app.random-coffee.com/login).

If needed, you can send them a password reset email: in your member list, select the members, then click "Actions" and "Reset password".

## How provisioning works

RandomCoffee applies each change as soon as your identity provider sends it:

- when your identity provider provisions a new person, for example a new hire, they are added to your members automatically;
- when an employee leaves and their account is deactivated or removed in your identity provider, the member is deactivated in RandomCoffee. They are not deleted.

The names of members provisioned through SCIM are managed by your identity provider: CSV imports and the HRIS sync do not change them.