> ## Documentation Index > Fetch the complete documentation index at: https://ryvn.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # SCIM directory > Connect your identity provider to provision people and Groups into Ryvn A SCIM directory lets your identity provider (IdP) provision people and [Groups](https://ryvn.ai/docs/guides/groups.md) into your Ryvn organization. Each organization can have one directory at a time. SCIM handles provisioning, not sign-in. Configure single sign-on (SSO) separately; creating or removing a SCIM directory does not configure or remove SSO. ## Before you begin * Have access to configure SCIM provisioning in your identity provider. * Select the Ryvn organization that should receive the people and Groups. * Have permission to view integrations (`integration.read`) and manage them (`integration.write`). If setup controls are missing, ask an organization administrator for access. ## Configure the directory **1. Create the directory** Open **Settings > Connections > SCIM directory** and click **Add connection**. In the popup, click **Create**. If a directory already exists, inspect it before replacing it. Removing a directory is not the same as rotating its token. **2. Copy the endpoint and token** Copy the exact **SCIM endpoint** and **Bearer token** returned by Ryvn. Store the token securely before closing the popup; it is shown only once. If you lose it, [rotate the token](#rotate-the-token). > [!WARNING] > > Treat the bearer token as a credential. Do not put it in source control, screenshots, logs, or support messages. **3. Configure your identity provider** In your IdP's SCIM provisioning settings, enter the returned endpoint as the base URL and the token as the bearer credential. Use the URL exactly as returned rather than substituting the Ryvn dashboard URL. Choose the people and Groups your IdP should send to Ryvn, then enable provisioning according to your provider's instructions. Check its provisioning results, **Settings > People**, and **Settings > Groups** in Ryvn. A configured directory alone does not confirm that the IdP has sent data. To grant access through a Group, [add it to a Team and use the Team in an access policy](https://ryvn.ai/docs/guides/groups.md#how-groups-grant-access). ## First sign-in > [!NOTE] > > Provisioning creates or updates a person's account but sends no invitation or email, sets no password, and does not link an SSO identity. To sign in for the first time, the person: > > 1. Opens the normal Ryvn login page and enters their provisioned work email. > 2. Signs in with your organization's SSO when Ryvn offers or requires it. The IdP must assert a verified email that matches the provisioned email. Ryvn then links the SSO identity to the existing account; no separate invitation or SSO auto-join is needed. > 3. Otherwise, uses the email sign-in link Ryvn sends, if your organization does not require SSO. > 4. Follows any setup prompts Ryvn shows. Provisioning does not complete these on the person's behalf. ## How people are provisioned Ryvn provisions people only into the directory's organization. Your IdP can find and update existing active or inactive human accounts whose home is that organization, not only people the directory created, so a directory association does not mean the directory originally created the account. In **Settings > People**, people associated with the directory show **Managed by SCIM**. * **Matching.** Configure your IdP to match existing people by `userName`, or by `externalId` once it is stored. Creating a person whose `userName` already exists fails with a conflict; let the IdP match and update that person instead. * **Email.** Map the email Ryvn receives to the address the person signs in with. New accounts and email addresses changed through SCIM are marked verified; an unchanged existing email keeps its verification status. Use the provisioned email for sign-in; `externalId` is not a sign-in identifier. * **Deactivation.** When your IdP sends `active: false`, Ryvn deactivates the person; their direct role grants are kept. Changing an inactive person back to `active: true` reactivates them and restores their organization membership. * **Deletion.** A SCIM delete request does not remove or deactivate the person in Ryvn. Deactivate them through SCIM with `active: false`, or remove their access in Ryvn. ## Inspect the configuration Return to **Settings > Connections > SCIM directory**. The directory row shows the endpoint, token version, and update time. Click the row to open a summary with the endpoint, token version, and token issue time. The existing token cannot be retrieved. ## Rotate the token Open the directory row's actions menu and choose **Rotate token**, then confirm **Rotate token**. Copy the new token from the popup and update your IdP's bearer credential. The endpoint and stored `externalId` values stay the same. > [!WARNING] > > Rotation invalidates the previous token immediately. Provisioning requests using it will fail until you update the IdP with the replacement token, which is shown only once. Check your IdP's next provisioning result after updating the credential. ## Remove or replace the directory Open the row's actions menu, choose **Remove**, and confirm **Remove**. This stops provisioning through that endpoint and invalidates its bearer token. It clears the directory's associations with people, including stored `externalId` values, but keeps the people, their memberships and access, Groups, Team assignments, and SSO. Removing the directory is not an access-revocation action. Creating a directory again produces a different directory, endpoint, and token. Update the IdP with both new values; it must match existing people again. Retained Groups still belong to their original directory; the replacement does not silently adopt them. Retained Group names remain reserved, so sending a new Group with the same name can cause a conflict. Review the old Groups and their Team references before [deleting retained Groups](https://ryvn.ai/docs/guides/groups.md#delete-a-retained-group). ## Troubleshooting | Symptom | What to check | | - | - | | A directory already exists | Inspect the existing configuration. Rotate its token if only the credential needs replacing. | | The IdP reports an authentication failure | Use the exact returned endpoint and current token. Check whether the token was rotated or the directory was replaced. | | People or Groups are missing | Check the selected Ryvn organization, IdP provisioning assignments, and the IdP's delivery errors. See [Group troubleshooting](https://ryvn.ai/docs/guides/groups.md#troubleshooting). | | Provisioning works but sign-in fails | Follow the [first sign-in](#first-sign-in) steps. Check that SSO asserts a verified email matching the provisioned email. | | The IdP reports a conflict creating a person | Match the existing person by `userName` and update them instead of creating them again. | If the directory cannot be configured, contact [Ryvn support](https://ryvn.ai/docs/support/contact-us.md) without including the bearer token.