---
title: Create a SCIM provisioning app in PingOne
slug: opti-id/docs/create-a-scim-provisioning-app-in-pingone
docTags: 
createdAt: 2026-07-20T15:45:14.193Z
---

:::hint{type="info"}
**Note**

Optimizely officially supports SCIM provisioning with Entra ID, Okta, and PingOne. Other IdPs are not officially supported for SCIM provisioning, and Optimizely does not assist with custom configuration or troubleshooting.
:::

You can configure a PingOne integration that uses System for Cross-domain Identity Management (SCIM) for provisioning. This securely automates and manages user identity information, such as user and group creation, updates, and deactivation from PingOne to Opti ID.

## Prerequisites

- Configure the [SAML or OIDC SSO connection in your identity provider (IdP)](docId\:GpDIlwNc6uRDWWbiPZ5CY). If you intend to use your IdP for provisioning and SSO, the best practice is to use two separate apps in your IdP: one to manage the SCIM integration and one to manage the SSO integration.
- Decide to use just-in-time (JIT) or SCIM for user and group provisioning. You cannot use JIT and SCIM at the same time. Default SSO in Opti ID uses JIT provisioning. Choosing SCIM automatically opts you out of JIT provisioning. Contact Optimizely Support to configure your SCIM organization.
- You must be in the **Admin Center Administrators** group in the Opti ID Admin Center.
- You must have administrator rights in your IdP account.

:::hint{type="info"}
**Note**

If you create multiple SSO connections, you can only use SCIM for one of those SSO connections.
:::

## Add an attribute in PingOne

1. Go to **Attributes** and click the **Add** (**+**) icon to add an attribute in your PingOne admin console.
2. Select **Declared** for the attribute type, then click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/wUCIUbgnUUHLFJRGjUwlL_add-an-attribute-in-pingone-1.png" size="100" isUploading="false" width="670" height="571" darkWidth="670" darkHeight="571" showCaption="false" indent="1"}

3. Enter a **Name** for the attribute, then click **Save** to finish creating the attribute.

::Image[]{size="100" isUploading="true" uploadStartedAt="1788084640043" showCaption="false" src="#" githubPath="docs/#" initialPath="#" indent="1"}

4. Add this newly created attribute to users you want to sync with Opti ID.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/v35LY_l3QR82NiMPgFX5n_add-an-attribute-in-pingone-3.png" size="100" isUploading="false" width="634" height="1167" darkWidth="634" darkHeight="1167" showCaption="false" indent="1"}

## Configure SCIM provisioning in PingOne

1. [Generate a SCIM token in Opti ID](docId\:uyPnSrCZLSHJ1LxbeOeaw). This token is required for step 7. It is your responsibility to keep this token secure.
2. Go to **Integrations > Provisioning** in PingOne.
3. Click the **Add** (**+**) icon, then select **New Connection** to create a provisioning connection.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/hI8Xq8bt_swvl79oxxBTv_configure-scim-provisioning-in-pingone-1.png" size="100" isUploading="false" width="800" height="649" darkWidth="800" darkHeight="649" showCaption="false" indent="1"}

4. Click **Select** for **Identity Store**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/WtkmhyIcWEHqehrZTGmcr_configure-scim-provisioning-in-pingone-2.png" size="100" isUploading="false" width="800" height="323" darkWidth="800" darkHeight="323" showCaption="false" indent="1"}

5. Select **SCIM Outbound**, then click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/-dSVp2UkllIIlmGvA1jSz_configure-scim-provisioning-in-pingone-3.png" size="100" isUploading="false" width="800" height="911" darkWidth="800" darkHeight="911" showCaption="false" indent="1"}

6. Enter a **Name**, then click **Next**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/ZR0tjYPuCrtygbMQCfxJJ_configure-scim-provisioning-in-pingone-4.png" size="100" isUploading="false" width="800" height="901" darkWidth="800" darkHeight="901" showCaption="false" indent="1"}

7. Complete the following information:
   - **SCIM Base URL** – Enter `https://identity-api.optimizely.com/api/scim/v2`.
   - **SCIM Version** – Enter *2.0*.
   - **Authentication Method** – Select **OAuth 2 Bearer Token**.
   - **Oauth Access Token** – Paste the token you generated from [Generate a SCIM token in Opti ID](docId\:uyPnSrCZLSHJ1LxbeOeaw).
   - **Auth Type Header** – Select **Bearer**.
   - **Users Resource** – Enter */Users*.
   - **Groups Resource** – Enter */Groups*.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/i4LpqysD3FC01pbfnvYRj_configure-scim-provisioning-in-pingone-5.png" size="100" isUploading="false" width="800" height="903" darkWidth="800" darkHeight="903" showCaption="false" indent="1"}

8. Click **Test Connection** to test whether the integration can connect to the SCIM API. If there are errors, ensure your base URL and API token are correct and try again.
9. Click **Next** after you confirm the API connection works.
10. Complete the following information if it is not already pre-filled, then click **Save** to finish creating the connection.
    - **User Filter Expression** – Enter *username Eq "%s"*.
    - **User Identifier** – Enter *userName*.
    - **Allow Users to be Created** – Select this checkbox.
    - **Allow Users to be Updated** – Select this checkbox.
    - **Allow Users to be Disabled** – Leave this toggled off.
    - **Allow Users to be Deprovisioned** – Select this checkbox.
    - **Deprovision on Rule Deletion** – Toggle this on.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/OlRbmk-ZGrOmTniS6ZJYm_configure-scim-provisioning-in-pingone-6.png" size="100" isUploading="false" width="783" height="886" darkWidth="783" darkHeight="886" showCaption="false" indent="1"}

11. After you create the connection, you should be taken back to the **Integrations > Provisioning** page.
12. Go to the **Connections** tab, select the SCIM connection you just created, and toggle the connection on.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/wQzzCRTegxVU9g8Y9Pp_Y_configure-scim-provisioning-in-pingone-7.png" size="100" isUploading="false" width="800" height="210" darkWidth="800" darkHeight="210" showCaption="false" indent="1"}

13. Go back to **Integrations > Provisioning**.
14. Click the **Add** (**+**) icon, then select **New Rule**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/au98PYdZnNj_Yhci6hWoA_configure-scim-provisioning-in-pingone-8.png" size="100" isUploading="false" width="800" height="142" darkWidth="800" darkHeight="142" showCaption="false" indent="1"}

15. Enter a **Name**, then click **Create Rule**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/lC0JgDBRj8Rlf_XY8N6fr_configure-scim-provisioning-in-pingone-9.png" size="100" isUploading="false" width="664" height="375" darkWidth="664" darkHeight="375" showCaption="false" indent="1"}

16. Click the **Add** (**+**) icon on the **Configuration** tab for the SCIM connection you created. This adds the SCIM connection to your rule.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/E2iHRa1LR1kzOwEeVdt_L_configure-scim-provisioning-in-pingone-10.png" size="100" isUploading="false" width="800" height="394" darkWidth="800" darkHeight="394" showCaption="false" indent="1"}

17. Click **Save**.
18. After you save the connection, you should be taken back to the **Integrations > Provisioning** page.
19. Go to the **Rules** tab and click the SCIM icon for the rule you just created to open the configuration window.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/WyNADIo-pQdddTjR7kXdi_configure-scim-provisioning-in-pingone-11.png" size="100" isUploading="false" width="800" height="185" darkWidth="800" darkHeight="185" showCaption="false" indent="1"}

20. Click **User Filter**, then click the Edit icon to edit the filter.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/53dn7LMT_t8OYf4ilslFI_configure-scim-provisioning-in-pingone-12.png" size="100" isUploading="false" width="800" height="341" showCaption="false" indent="1"}

21. Add the following user filter, then click **Save**.
    - **Attribute** – Select the attribute you created in the [Add an attribute in PingOne](https://support.optimizely.com/hc/en-us/articles/30501318968973-Create-a-SCIM-provisioning-app-in-PingOne#h_01J8G4GDRP62RY9Z4C1MKXA4DC) section.
    - **Operator** – Select **Equals**.
    - **Value** – Enter *true*.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/MtN8apNLM9-NFCs2cCLP8_configure-scim-provisioning-in-pingone-13.png" size="100" isUploading="false" width="800" height="162" darkWidth="800" darkHeight="162" showCaption="false" indent="1"}

22. Click **Attribute Mapping**, then click the **Edit** icon to edit the mapping.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/3S7lr5cH7Yi8QzuMk0zMY_configure-scim-provisioning-in-pingone-14.png" size="100" isUploading="false" width="800" height="709" darkWidth="800" darkHeight="709" showCaption="false" indent="1"}

23. Make the following changes, then click **Save**.
    - Delete the **Email Address** and **Primary Phone** attributes.
    - Expand the **Username** drop-down list in the **PingOne Directory** column and select **Email Address**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/UXYpV45Qf-D2PPBPqFBf__configure-scim-provisioning-in-pingone-15.png" size="100" isUploading="false" width="747" height="334" darkWidth="747" darkHeight="334" showCaption="false" indent="1"}

24. Click **Group Provisioning**, then click **Add Groups**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/Nc_ysJHjzLXtkEPyqQBm3_configure-scim-provisioning-in-pingone-16.png" size="100" isUploading="false" width="800" height="508" darkWidth="800" darkHeight="508" showCaption="false" indent="1"}

25. Select the groups you want to sync with Opti ID, then click **Save**.
26. Toggle the rule on.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/1fzbMYoKyIYEgAnZDbt5L_configure-scim-provisioning-in-pingone-17.png" size="100" isUploading="false" width="800" height="171" showCaption="false" indent="1"}

27. This initiates the sync to Opti ID. The results display in PingOne when it is complete.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/zaXtDBP2MekluykiI0gRJ_configure-scim-provisioning-in-pingone-18.png" size="100" isUploading="false" width="800" height="408" darkWidth="800" darkHeight="408" showCaption="false" indent="1"}

## User management in Opti ID

:::hint{type="info"}
**Note**

SCIM syncs only groups and users from your SSO. Instances, roles, and permissions are managed within the Opti ID Admin Center. When using SCIM provisioning, performing a group push creates [internal groups](../../opti-id/manage-the-admin-center/manage-groups.mdx) in Opti ID.
:::

In addition to managing users and groups through your IdP, you have the flexibility to continue managing non-IdP users and groups directly through the Opti ID Admin Center:

- Manually add collaborators or partners and groups.
  - You should manage your SSO users with an upstream IdP.
  - See [Add external collaborators to an SSO organization](../../opti-id/get-started/authentication/add-external-collaborators-to-an-sso-organization.mdx) to manage external collaborators.
- Assign a product instance to a group.
- Assign roles to product instances.

Only make the following changes in your upstream IdP and let it flow downstream to Opti ID. Do *not* make these changes in the Opti ID Admin Center:

- Edit users' first and last names. This causes a discrepancy between the IdP and Opti ID.
- Edit group names and user memberships of groups provisioned from SCIM to Opti ID. This causes out-of-sync user assignments for your SSO users. Instead, create separate groups for collaborators or partners in Opti ID because those are not managed by SCIM provisioning.
- Delete users and groups. This makes that resource unavailable for updates from the IdP.

The following groups are reserved only for internal Opti ID use. Do *not* link them to your Opti ID SCIM application:

- **Everyone**
- **Admin Center Administrators**

## Troubleshoot

PingOne's audit log records system events related to your organization, providing an audit trail that you can use to understand platform activity and diagnose problems. You should start with PingOne's audit log when troubleshooting issues related to your Opti ID SCIM provisioning in PingOne.

## Frequently Asked Questions (FAQ)

**If your organization is already onboarded to Opti ID using SSO and JIT, what happens to existing users when your organization switches to using SCIM?**

There will not be any issues with users created in the Opti ID Admin Center, as these users are mapped to newly assigned groups from the upstream IdP during SCIM provisioning.

**If your organization is already onboarded to Opti ID using SSO and JIT, what happens to existing groups when your organization switches to using SCIM?**

Opti ID has three group types. See [Manage groups](../../opti-id/manage-the-admin-center/manage-groups.mdx) for the list of group types and their descriptions.

If your organization wants to manage users with groups that have the same name as previously created **Custom** groups in Opti ID, then you must delete those groups in Opti ID before enabling SCIM provisioning.

You cannot delete **Product** user groups in Opti ID. When you enable SCIM, any group you create on your side cannot have the same name as a **Product** group in Opti ID. You must pick a different name (like, *Opti\_SCIM\_\<existing-Product-user-group-name>*) and assign that SCIM group the same access that the corresponding group has in Opti ID. After you enable SCIM, do not use previously defined **Product** groups.