---
title: "Set up user provisioning (SCIM)"
slug: "configure-user-provisioning-with-saml-sso"
updated: 2026-09-03T20:25:14Z
published: 2026-07-08T13:41:13Z
canonical: "support.tulip.co/configure-user-provisioning-with-saml-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.tulip.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up user provisioning (SCIM)

*You can use user provisioning and deprovisioning alongside SAML to provision and deprovision users instantly.*

          Who can use this feature

          

Users on Professional plans and above.

## Overview

After [setting up SAML SSO in Tulip](/r230/docs/set-up-saml-sso), you may also want to provision and de-provision users in real time, following the [SCIM API](https://scim.cloud/). You can set up this behavior after finishing your SAML SSO setup.

## Technical requirements

Go to **Account Settings** and click the **SAML** page. Select the **SCIM** tab.

![image.png](https://cdn.document360.io/7c6ff534-cad3-4fc8-9583-912c4016362f/Images/Documentation/image-GLQUUKFA.png)

There, you will see the following fields related to the Tulip application:

- Tenant URL
- API Key/Secret (Bearer token authentication)

Add these to the metadata about the Tulip application as a "service provider" within your IdP.

## Supported features

Tulip supports the following real-time updates via the SCIM API:

- User creation
- Updates to a user's name
- User deletion / de-provisioning

### User creation

Within your IdP, you control which users have access to the Tulip application.

When Tulip becomes registered as a Service Provider, your IdP will use the SCIM API to provision all users who need access to Tulip. Those users will be created automatically in Tulip with no access to any part of the platform.

After you set up SAML in Tulip, when a user logs in with SAML for the first time, they will be assigned a workspace and role based on your SAML configuration.

Then, when a new user is added to your IdP who should have access to Tulip, they will be immediately provisioned in Tulip with no access to any other part of the platform.

### Updates to user name

When a user's name is updated in your IdP, or if you modify the order of family name and given name in Tulip's SCIM settings, user names will update in real time in the Tulip platform.

### User deletion / deactivation

The SCIM API uses the term "delete" related to de-provisioning users, but users in Tulip can only be deactivated, not deleted. Tulip expects the "delete user" endpoint to only be used when deprovisioning users.

When the "delete user" endpoint is used for a given user, they will be immediately deactivated in Tulip.

---

Did you find what you were looking for?

You can also head to [community.tulip.co](https://community.tulip.co/?utm_source=intercom&utm_medium=article-link&utm_campaign=all) to post your question or see if others have solved a similar topic!

**Security Assertion Markup Language**

**Security Assertion Markup Language** is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. Within Tulip, SAML can be used to authenticate **Users.**

**Single Sign On**

**Single sign-on** is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems. True single sign-on allows the user to log in once and access services without re-entering authentication factors