Provisioning people with SCIM

SCIM lets your identity provider look after the people in your Everdeck account. When someone joins your company, the provider adds them here; when they move team, their company roles follow their groups; when they leave, the provider deactivates them and they lose access at once. Okta, Microsoft Entra ID and any other SCIM 2.0 client work.

SCIM is part of the Scale plan. Account owners and admins set it up on the Account page: select the Security tab, and use the Provisioning (SCIM) card. Every change there asks you to confirm it's you with your second factor.

Turn it on

1. Open Account, select the Security tab, and verify your organisation's email domain under Domains (see Single sign-on). SCIM adds only people whose work email is on one of your verified domains.
2. Find Provisioning (SCIM) and select Create SCIM token. Copy the token straight away: Everdeck stores only a fingerprint of it and won't show it again.
3. In your identity provider, add Everdeck as a SCIM app. Paste the SCIM base URL from the card as the SCIM connector base URL (Okta) or the tenant URL (Entra), and the token as the bearer token or secret token.
4. Choose what your provider matches people on. Everdeck matches on userName (Okta's usual choice is the email address, Entra's the user principal name) and on externalId.
5. Test the connection, then assign people and push groups.

Everyone the provider sends needs a work email, in emails or as userName, on one of your account's verified domains. It's the address they sign in with. Your identity provider shows an error for anyone else: verify their domain, then retry. Someone new to Everdeck gets a login with no password: they sign in through your identity provider (SSO) or set a password with Forgot your password? on the sign-in page, which proves the address. Someone who already has an Everdeck login is added to your account with that login. If that login's address was never verified, Everdeck can't know whoever made it owns the address: it removes the login's password, second factors and sessions first, and records that in the audit log.

Groups decide company roles

Push groups from your identity provider, then choose what each one gives in Everdeck. In the card's Groups list, select Set roles next to a group, choose a role in each company it should open (Company admin, Manager, Operator, Viewer or Portal), and select Save roles. Everyone in the group gets those roles at once.

• In a company two of someone's groups map to, the stronger role wins.
• Someone with a console role anywhere is an account Member and takes a seat. Someone whose groups give only the Portal uses the Portal and takes no seat.
• In a company a group maps to, roles follow the groups: a role someone changes by hand in Everdeck goes back to what the groups give the next time the provider updates that person. Companies no group maps are left as people in Everdeck set them.
• Removing someone from a group, unmapping a company or deleting the group takes away the role it gave.

People in no mapped group sets what everyone else gets when they join: the Portal (no seat, no company yet), or Member (a seat, no company yet). Change it and select Save default.

Owners, admins and billing users keep the access you gave them in Everdeck: groups don't change their roles. Your identity provider can still deactivate an admin or a billing user. It can't remove the account owner: the owner transfers ownership first, on the Members page.

Seats and limits

Provisioning follows your plan like inviting does. A person who needs a seat when every seat is in use is refused, and your identity provider shows the error with the plan's limit. Portal people count toward the Portal's own cap instead. Free a seat or upgrade, then retry in your identity provider.

If your account leaves the Scale plan, your identity provider can no longer add people or give roles, but it can still deactivate people, so nobody keeps access because the plan changed.

When someone leaves

When your identity provider deactivates someone (Okta deactivates; Entra sets them inactive, then may delete them), Everdeck at once:

• takes them out of the account and every company in it;
• hands their open tasks back to whoever asked for them, or leaves them unassigned;
• makes agents that reported to them report to nobody;
• revokes the invitations they sent;
• ends the sessions your identity provider started for them, and signs them out everywhere else too, unless they also belong to another Everdeck account, where they keep their access.

Reactivating them in your identity provider brings them back with the roles their groups give.

The people directory

When your identity provider sends a person's job title, or the enterprise extension's department and manager, Everdeck writes them to the person's row in each company's people directory they belong to. A manager is set when that manager is in the same company's directory; one that would make someone report to themselves, directly or through others, is left out.

The row of someone your identity provider provisions is kept by SCIM. If a directory sync brought that person in, the sync lets go of their row and leaves it alone from then on, so the two never overwrite each other.

Rotate or turn off the token

Select Rotate token and confirm to replace the token. The old one stops working at once, so paste the new one into your identity provider straight away. Select Turn off SCIM and confirm to refuse every request from your identity provider until you create a new token. Turning it off removes nobody.

The card shows when the token was made, by whom and when it was last used. Every change your identity provider makes is in the account's audit log, with the identity provider as the actor.