About this block

SCIM Provisioning Settings is the directory sync panel for an Okta connection over SCIM 2.0. A Sync active badge sits beside the heading, and a three column stat strip reports users synced (148), groups mapped (12), and the last run (6 min ago). The connection section shows the SCIM base URL and a masked bearer token with a Rotate token action, warning that rotation invalidates the old token at once and IdP requests will fail with 401 until it is updated. A monospace attribute mapping grid pairs directory fields with profile fields, and a note explains that values flow one way and mapped fields become read only. Two deprovisioning radio rows close the panel, each spelling out what happens to a removed member.

Sync stats, attribute mappings, and deprovision options are three typed const arrays. The deprovisioning copy is the content that matters most; the label alone would not tell an admin whether history survives.

When to use

Reach for this block on the security or authentication settings page, visible to owners only, wired to your SCIM endpoint and IdP configuration. Pair the Rotate token action with a confirmation step so a stray click cannot break provisioning.

A natural flow around it on an Application Pro page:

Before

• SSO and domain settings
• Settings shell

After

• Member roles table
• Teams and orgs

What you can display

One strong use is the workspace directory sync panel. Other provisioning surfaces:

• Group role mapping. A grid pairing directory groups with workspace roles instead of profile attributes.
• Sync history. A table of recent runs with counts, duration, and any records that failed to provision.
• Multiple IdPs. The same connection section repeated for each directory feeding the workspace.

Tip: name the deprovisioning outcome in full; an admin deciding between deactivate and delete needs to know whether authored content stays attributed.