About SCIM

System for cross-domain identity management (SCIM) can be used to automatically provision members and groups in your Bitwarden organization.

Bitwarden servers provide a SCIM endpoint that, with a valid SCIM API Key, will accept requests from your identity provider (IdP) for user and group provisioning and de-provisioning.

Bitwarden supports SCIM v2 using standard attribute mappings and offers official SCIM integrations for:

• Azure Active Directory

• Okta

• OneLogin

• JumpCloud

• Ping Identity

To set up SCIM, your IdP will need a SCIM URL and API key to make authorized requests to the Bitwarden server. These values are available from the Admin Console by navigating to Settings → SCIM provisioning:

Bitwarden uses standard SCIM v2 attribute names, listed here, however each IdP may use alternate names which are mapped to Bitwarden during provisioning.

User attributes

For each user, Bitwarden will use the following attributes:

• An indication that the user is active (required)

• emailª or userName (required)

• displayName

• externalId

ª - Because SCIM allows users to have multiple email addresses expressed as an array of objects, Bitwarden will use the value of the object which contains "primary": true.

Group attributes

For each group, Bitwarden will use the following attributes:

• displayName (required)

• membersª

• externalId

ª - members is an array of objects, each object representing a user in that group.

Once users are provisioned in Bitwarden using SCIM, you can temporarily revoke their access to your organization and its vault items. When a user is temporarily suspended/de-activated in your IdP, their access to your organization will automatically be revoked.

Users with revoked access are listed in the Revoked tab of the organization's Members screen and will:

• Not have access to any organization vault items, collections.

• Not have the ability to use SSO to login, or organizational Duo for two-step login.

• Not be subject to your organization's policies.

• Not occupy a license seat.

Learn more about revoking and restoring access.

Your organization will capture event logs for actions taken by SCIM integrations, including inviting users and removing users, as well as creating or deleting groups. SCIM-derived events will register SCIM in the Member column.

Organizations with users and groups that were onboarded before activating SCIM, either manually or using Directory Connector, should note the following:

Users that belong to an organization using SCIM are able to change their email address in Bitwarden and their organization's relevant IdP. In order to change a Bitwarden email address in a SCIM organization:

1. Change the email address in Bitwarden by navigating to Settings → My account (more information here).

2. Once the email has been changed on Bitwarden, update the user value on the IdP or AD client. This could be the externalid or a corresponding value, depending on the organization's choice of IdP.

3. Re-sync the IdP or AD client to implement the changes.