Create, update, and deactivate Nucleus OS users automatically from your identity provider with SCIM 2.0.

SCIM 2.0 keeps Nucleus OS accounts in sync with your identity provider. When someone is assigned the app in your IdP they get an account; when they are removed or disabled, they lose access automatically.

What SCIM handles

IdP action	Result in Nucleus OS
Assign user to the app	Account created (learner role by default)
Update name or email	Profile updated
Assign to a group	Group membership updated, which you can use in enrollment rules
Unassign or disable user	Account deactivated; history kept for compliance

Setup

Generate a SCIM token

In your workspace security settings, enable SCIM. Nucleus OS shows the SCIM base URL and generates a bearer token. Copy the token now; it is shown only once.

Configure your IdP

In your IdP's provisioning settings for the Nucleus OS app, enter the base URL and token, and enable create, update, and deactivate.

Map attributes

Map at least userName (work email), name.givenName, name.familyName, and active. Optional: title, department, and manager.

Push groups (optional)

Push IdP groups to use them in enrollment rules, for example "everyone in the Sales group".

Protect the token

The SCIM token can create and deactivate users in your workspace. Store it only in your IdP, rotate it if it may have been exposed, and revoke old tokens after rotation.

SCIM and HRIS sync

SCIM controls who can sign in. HRIS sync adds the context (team, manager, location, start date) behind enrollment rules. If both send the same attribute, choose one system of record for it in the field mapping.

SCIM provisioning