Skip to content

SCIM FAQ#

Common questions about SCIM 2.0 provisioning between the BSR and an Identity Provider (IdP). For end-to-end setup, see the SCIM overview and the IdP-specific guides for Okta and Microsoft Entra ID.

How do I resolve a failed user provision?#

When the IdP provisions a user, its SCIM connector first tries to match the IdP user against an existing BSR user by email address. A failed provision usually means that match conflicts with an existing BSR account: same email, different userName, or a stale account left from an earlier login.

Try these in order:

  1. Confirm the user has signed in and signed out of the BSR at least once recently. The session activity is what produces the BSR-side account that SCIM tries to match.
  2. Check that the IdP maps the correct values to the SCIM email and userName fields. See the IdP-specific instructions for the supported mappings: Okta, Microsoft Entra ID. The BSR only supports SCIM for the IdPs listed in the overview; for other IdPs, contact Support or your Buf representative.

If the IdP still reports a conflict or the BSR ends up with two accounts for the same person, reconcile the linkage explicitly:

  1. Deprovision the user from the application in your IdP.
  2. Fix any attribute misconfigurations.
    • Use the user’s email as their SAML NameId.
    • Map the SCIM userName to the field specified by the setup guide for your IdP.
  3. Re-provision the user in the application in your IdP.

If two BSR accounts remain after that, contact Support or your Buf representative. There is no self-serve account merge.

I provisioned a user from my IdP but ended up with two BSR accounts that have slightly different usernames. What do I do?#

Run the same deprovision, fix the IdP email and userName mappings, and re-provision flow described in How do I resolve a failed user provision?. If both accounts still exist after that, contact Support or your Buf representative; the BSR doesn’t expose a self-serve merge.

Can I use SCIM without automated organization provisioning?#

Only if you don’t push IdP groups to the BSR.

If you do push groups via SCIM, configure automated organization membership provisioning. Without it, login-time group reconciliation treats the groups in the user’s SSO session as the source of truth and removes them from any organizations not present there. A later SCIM push may re-add them, but the state will keep flapping between sign-ins and SCIM sync.