Overview
System for Cross-domain Identity Management (SCIM) enables automated user lifecycle management between your Identity Provider (IdP) and Caralegal.
Once configured, your Identity Provider becomes the single source of truth for user management. Creating, updating, disabling or reactivating users in your IdP is automatically reflected in Caralegal, eliminating manual administration and reducing the risk of outdated user accounts.
Caralegal supports the SCIM 2.0 standard and can be integrated with identity providers such as Microsoft Entra ID, Okta, Keycloak, SailPoint and other SCIM-compliant solutions.
What SCIM Can Provision
Depending on your requirements, SCIM can synchronize the following information:
User accounts
User profile information (name, email address, etc.)
User activation and deactivation
Roles
Primary Organization Unit
Additional Organization Units
You can start with basic user provisioning and add role or organization mapping later if required.
Recommended Identity Configuration
One of the most important implementation decisions is how users are uniquely identified.
Caralegal strongly recommends using an immutable identifier (such as the Microsoft Entra Object ID) instead of the user's email address.
Recommended Configuration
SCIM Attribute | Recommended Value |
externalId | Immutable Object ID |
userName | User's email address |
With this configuration:
email address changes are synchronized automatically
users keep the same identity throughout their lifecycle
no manual intervention is required after name or email changes
duplicate user accounts are avoided
For all new customer implementations, Caralegal recommends enabling Automatic Email Address Update and using the immutable identifier as the primary matching attribute.
User Lifecycle
SCIM supports the complete user lifecycle.
The following events can be synchronized automatically:
Create new users
Update user information
Disable users
Re-enable users
Changes made in your Identity Provider are reflected automatically in Caralegal during the next provisioning cycle.
Role Provisioning
If required, user roles can be managed directly from your Identity Provider.
This ensures that permissions remain synchronized and eliminates the need for manual role assignment within Caralegal.
If no role mapping is configured, Caralegal assigns the tenant's default role to newly provisioned users.
Organization Unit Mapping
Caralegal supports assigning users to organizational units during provisioning.
Two attributes are available:
Main Organization Unit – the user's primary organizational assignment.
Further Organization Units – additional organizational memberships.
Organization Unit values received from your Identity Provider are mapped to the corresponding organizational units in Caralegal.
Example for Attribute Matching in Entra
Before You Start
To ensure a smooth implementation, we recommend that you prepare the following information before configuring SCIM:
Your Identity Provider supports SCIM 2.0.
A test user is available for validation.
You have identified whether role provisioning is required.
You have identified whether Organization Unit mapping is required.
Your Caralegal tenant has been prepared for SCIM provisioning.
Your Caralegal implementation team will provide the SCIM Base URL, authentication token and implementation guidance.
Best Practices
For a successful implementation, we recommend the following approach:
Configure basic user provisioning first.
Validate the complete user lifecycle (create, update, disable and re-enable).
Configure role provisioning, if required.
Configure Organization Unit mapping, if required.
Perform user acceptance testing before enabling production synchronization.
Following this sequence simplifies troubleshooting and helps ensure a successful deployment.
Need Help?
If you have questions during your SCIM implementation, please contact Caralegal Support. Our team can assist with tenant preparation, attribute mapping, validation and troubleshooting throughout your onboarding process.