SCIM 2.0 · Okta · Microsoft Entra ID

SCIM provisioning

Let your identity provider create, update and deactivate Temsor users. When someone leaves, they lose access to Temsor the moment your IdP deactivates them — nobody has to remember to remove them by hand.

Before you start

1. You are an owner or admin of the Temsor workspace.
2. Your company e-mail domain is verified in Temsor » Security » Single sign-on. Temsor only provisions people whose e-mail address is on a verified domain.
3. In Temsor » Security » SCIM provisioning, select Create token. If you signed in more than 15 minutes ago, Temsor asks you to sign in again first. Copy the token right away — it starts with tscim_ and is shown only once.
4. Keep the SCIM base URL from the same card at hand: https://api.temsor.com/scim/v2.

Okta

1. In the Okta Admin Console, go to Applications » Applications » Create App Integration, choose SWA – Secure Web Authentication, and name the app Temsor (sign-in URL https://app.temsor.com/). If you already have a Temsor app in Okta, open it instead.
2. On the General tab, select Edit under App Settings, set Provisioning to SCIM, and save.
3. On Provisioning » Integration, select Edit and enter: SCIM connector base URL https://api.temsor.com/scim/v2; Unique identifier field for users userName; Supported provisioning actions Push New Users and Push Profile Updates (turn on Push Groups only if you manage roles with groups — see Roles from IdP groups; leave Import Groups off); Authentication Mode HTTP Header, with the token pasted as the Bearer token.
4. Select Test Connector Configuration, then Save.
5. On Provisioning » To App, select Edit and turn on Create Users, Update User Attributes and Deactivate Users.
6. On the Assignments tab, assign the people or groups who should use Temsor. Okta provisions them right away.

Okta sends the Okta username as userName. It must be the person's work e-mail address on your verified domain.

Microsoft Entra ID

1. In the Microsoft Entra admin center, go to Enterprise apps » New application » Create your own application, enter Temsor, choose Integrate any other application you don't find in the gallery (Non-gallery), and create it.
2. Open Provisioning, select Get started (or New configuration), and set Provisioning Mode to Automatic.
3. Under Admin Credentials, enter Tenant URL https://api.temsor.com/scim/v2 and paste the token as Secret Token. Select Test Connection, then Save.
4. Under Mappings, set Provision Microsoft Entra ID Groups to No (Yes if you manage roles with groups — see Roles from IdP groups). In the user mapping, keep userName ← userPrincipalName (use mail instead if your UPNs aren't e-mail addresses) and map externalId ← objectId. Leave active as Entra maps it.
5. Under Settings, keep Scope at Sync only assigned users and groups, set Provisioning Status to On, and save.
6. Under Users and groups, assign the people or groups who should use Temsor. Entra runs a provisioning cycle about every 40 minutes; use Provision on demand to push one person immediately.

Roles from IdP groups

Temsor has four fixed groups, one per role: Temsor Admins, Temsor Developers, Temsor Billing and Temsor Viewers. Push IdP groups with exactly these names and Temsor sets each person's role from their groups. Groups are optional — if you don't push any, manage roles in Temsor » Team.

Before you push groups, put the admin who created the SCIM token in Temsor Admins. If a group push gives that person any other role, Temsor revokes their token and provisioning stops with 401 until an admin creates a new one.

• Okta: in Provisioning » Integration, select Edit, also turn on Push Groups, and save. Name the Okta groups exactly as above and assign them on the Assignments tab. Then on the Push Groups tab, select Push Groups » Find groups by name, choose the group and save — Okta links it to the Temsor group with the same name.
• Microsoft Entra ID: under Mappings, set Provision Microsoft Entra ID Groups to Yes and keep the default group mapping (displayName ← displayName, members ← members, matched on displayName). Name the security groups exactly as above and assign them under Users and groups — their members are provisioned too.

• More than one group: the most privileged one wins — Admins, then Developers, then Billing, then Viewers.
• Removed from their last Temsor group: the person stays active as a Viewer. To take away access, unassign or deactivate them.
• Once your workspace uses groups, new people start as Viewer until a group gives them a role. Someone who is deprovisioned and comes back starts as Viewer again.
• Your IdP is the source of truth. A role changed in Temsor » Team is overwritten the next time your IdP pushes a group change for that person.
• The workspace owner's role never changes through groups. Their memberships are recorded, so after an ownership transfer the previous owner gets the role of their groups.
• Groups can't be created or renamed in Temsor. Pushing any other name fails with 400. Deleting a group in your IdP removes everyone from it; the Temsor group itself stays.

What Temsor does with each change

• New user: joins your workspace with the Developer role, or Viewer if your workspace manages roles with groups. Change roles in Temsor » Team or with groups.
• Already a member: if the person is already in your workspace, Temsor links the existing account instead of creating a new one.
• Deactivated or unassigned in your IdP (active = false): the account is suspended, all of the person's Temsor sessions — portal and IVR Studio — end immediately, and they can't sign back in. Reactivating restores their previous access.
• Deleted: the person is suspended and disappears from SCIM results. Call history, invoices and the audit log are kept.
• The workspace owner can't be deactivated or deleted through SCIM. Transfer ownership in Temsor first.
• The e-mail address (userName) can't change. To move someone to a new address, deprovision the old one and provision the new one.
• API keys belong to the workspace, not to a person. Suspending someone doesn't revoke keys they created — revoke those in Temsor » Keys if needed.

Reference

• Base URL https://api.temsor.com/scim/v2 · header Authorization: Bearer tscim_… · content type application/scim+json.
• GET and POST /Users; GET, PUT, PATCH and DELETE /Users/{id}; GET and POST /Groups; GET, PUT, PATCH and DELETE /Groups/{id}; GET /ServiceProviderConfig, /ResourceTypes and /Schemas.
• Filters: userName eq "…", externalId eq "…" and id eq "…". Paging with startIndex and count, up to 200 per page.
• Temsor reads userName, externalId, displayName, name.givenName, name.familyName and active. Other attributes, including enterprise extensions, are ignored.
• Groups: ids role-admin, role-developer, role-billing and role-viewer; filters displayName eq "…" and id eq "…"; add excludedAttributes=members to skip member lists; up to 1000 members per request. PATCH accepts Okta members[value eq "…"] removals and Entra Add/Remove operations.
• Not supported: creating or renaming groups, nested groups, bulk operations, sorting, ETags and password changes.
• One token per workspace. Creating a new token revokes the old one immediately. Revoking stops provisioning; existing users keep their access.

Troubleshooting

• 401 Missing or invalid SCIM bearer token — the token was revoked or replaced. Create a new one and paste it into your IdP.
• 400 This e-mail's domain isn't verified for this workspace — verify the domain in Temsor » Security » Single sign-on, then retry.
• 409 This e-mail already belongs to another Temsor workspace — the person has their own workspace. Ask them to leave or delete it, then retry.
• 400 The workspace owner can't be deprovisioned — transfer ownership first, or remove the owner from the assignment.
• 400 Temsor only has fixed role groups — rename the IdP group to Temsor Admins, Temsor Developers, Temsor Billing or Temsor Viewers, then push it again.
• 401 right after a group push — the admin who created the token lost the Admin role. Add them to Temsor Admins and create a new token.

Temsor implements the SCIM 2.0 User and Group resources (RFC 7643 and RFC 7644).