Automated Provisioning & De-provisioning with SCIM

Who can use this feature?
- Requires an Enterprise plan.
- Requires an Admin role to configure.

This article provides guidance for configuring System for Cross-domain Identity Management (SCIM) for your Fullstory account, enabling automated user & group provisioning, updating, and de-provisioning through your identity provider (IdP). This streamlines your user management processes and enhances the security of your Fullstory account. Remember to consult the documentation for your specific identity provider for any variations in the configuration steps. 

This article will cover the following:

Please note: While our published Okta and Microsoft Entra ID apps don't currently support SCIM, you can follow the steps below to enable SCIM provisioning by creating new custom SAML apps in Okta or Microsoft Entra ID.

Create a new SAML app in Okta

Please note: If your SAML SSO is already configured using the Fullstory app in Okta, you'll need to remove this connection and create a custom SAML app.
  1. In the Admin Console, go to Applications.
  2. Click Create App Integration.
  3. Select SAML 2.0 as the Sign-in method.
  4. Click Next.
  5. Provide the general information for the integration and then click Next.
  6. Provide the necessary SAML settings information for your integration. See Application Integration Wizard SAML field reference for descriptions of individual fields.
  7. Click Preview the SAML Assertion to view the XML generated from the SAML settings that you provided.
  8. Click Next.
  9. Provide configuration information about your app integration to Okta:
    • If you're adding an integration for internal use only, follow these steps:
      1. Select I'm an Okta customer adding an internal app.
      2. Select This is an internal app that we have created. However, if your app requires more SAML configuration instructions to work with Okta, select It's required to contact the vendor to enable SAML. Fill in the provided fields to help the Okta support team understand your SAML configuration.
      3. Click Finish.
    • Your integration is created in your Okta org. You can modify your integration's parameters and assign it to users.
  10. After you create your SAML app integration, you can follow the SSO setup described in the How do I configure SSO? article.

Enabling SCIM in Fullstory

Note: If you're setting up SSO for the first time in an Umbrella account, repeat these steps for each account in your Umbrella.
  1. Within Fullstory, go to Settings > Account Management > SSO. 

  2. Under Sign On Settings, copy and paste the Assertion Consumer Service (ACS) URL and Entity ID (Audience URL) into your identity provider. Copy the XML generated by your IdP, and paste the content into the Metadata field in Fullstory. Click Next.

    • If desired, you may download the Request Signing Certificate at this step at any time.

  3. Under Provisioning, select SCIM Provisioning. Copy the API URL and paste it into your identity provider.

    • If you’re setting up a new SSO connection, first save the connection, then click Generate Authorization Token. If you’re updating an existing SSO connection, click Generate new token. Keep this information secure as it will be used to authorize the connection from your IdP.

  4. Click Complete setup to save your new SCIM connection.

Setting up the SCIM connection in Okta

The following steps provide an example of how to configure SCIM with Okta. The specific steps may vary depending on your IdP.

  1. From your Okta Admin console, navigate to Applications > Applications.
  2. Select the Okta Application that you have configured for Fullstory SSO.
  3. For the selected Okta Application, click on the General tab and then click Edit.
  4. Under Provisioning, select SCIM and click Save. This will add a Provisioning tab to your Fullstory Okta application.
  5. Click on the new Provisioning tab.
  6. Under Integration, click Edit.
  7. Using the information obtained from Fullstory in the previous section, fill out the following details:
    • SCIM connector base URL
    • Unique identifier field for users
    • Supported provisioning actions
    • Authentication Mode
    • Authorization token
  8. Click Test Connector Configuration.
  9. If the test is successful, click Save.

Mapping User Roles via SCIM Attributes (Recommended)

To automatically assign Fullstory roles to users based on their group memberships in Okta, follow these steps:

  1. To automatically assign Fullstory roles to users based on their group memberships in Okta, follow these steps:

    1. In Okta, navigate to Directory > Profile Editor.

    2. Select your Fullstory Okta Application and click + Add Attribute.

    3. Fill out the attribute details with the following information:

      1. Data Type: String

      2. Display Name: Fullstory Role

      3. Variable Name: role

      4. External Namespace: urn:ietf:params:scim:schemas:extension:fullstory:2.0:User

      5. Define enumerated list of values: Checked

    4. Add the following Attribute Members with their corresponding Value (Note: The umbrella manager role is not supported via SSO role mapping or SCIM attributes):

      1. Admin: admin

      2. Architect: architect

      3. Standard: standard

      4. Explorer: explorer

      5. Guest: guest

    5. Ensure Attribute Type is set to Group.

    6. Click Save.

    7. In Okta, navigate back to your Fullstory Okta application and click on the Assignments tab.

    8. Add the groups you want to map to Fullstory roles.

    9. Click the pencil icon to open the Edit Group Assignment screen, you should now see the Fullstory Role attribute.

    10. Select the desired Fullstory role from the dropdown that you want to assign to members of this Okta group.

    11. Click Save and repeat this for all relevant Okta groups.

Enabling SCIM Functionality in the Fullstory Okta App

  1. From the Okta Application, navigate to Provisioning > To App and click Edit.

  2. Select the provisioning features you want Okta to manage. It is recommended to enable Create Users, Update User Attributes, and Deactivate Users.

  3. Click Save.

Converting Existing Users to SCIM Users (If Applicable)

If you already have users assigned to the Fullstory Okta application before configuring SCIM, you may need to manually provision them via SCIM:

  1. In the Okta Application, navigate to the Assignments tab.
  2. Click Import Now to reconcile any differences between the users currently in FSTA and those assigned in Okta

Setting up the SCIM connection in Microsoft Entra ID

The following steps provide an example of how to configure SCIM with Microsoft Entra ID. Fullstory's published Entra ID gallery application ("Fullstory SAML") supports single sign-on, but it doesn't have an approved SCIM listing with Microsoft yet. To enable SCIM provisioning, create a second, separate application dedicated to provisioning; keep your existing "Fullstory SAML" application configured for sign-in. The application you create below is used only for provisioning and won't appear as a sign-in option for your users.

  1. Sign in to the Microsoft Entra admin center as at least an Application Administrator.

  2. Browse to Entra ID > Enterprise apps > New application.

  3. Select Create your own application.

  4. Enter a name that's easy to tell apart from your SSO app (for example, "Fullstory SCIM"), select Integrate any other application you don't find in the gallery (Non-gallery), then click Create.

Configure the SCIM connection

  1. In your new application, select Provisioning in the left panel, then click Get started.

  2. Set Provisioning Mode to Automatic.

  3. Under Admin Credentials, using the information obtained from Fullstory in the Enabling SCIM in Fullstory section above, enter the following:

    • Tenant URL

    • Secret Token

  4. Click Test Connection. Microsoft Entra ID confirms it can reach Fullstory's SCIM endpoint.

  5. If the test is successful, click Save.

Mapping User Roles via SCIM Attributes (Recommended)

To automatically assign Fullstory roles to users based on an app role assignment in Microsoft Entra ID, follow these steps:

  1. Add a role attribute to the app's schema:

    1. In your provisioning app, select Mappings, then Provision Microsoft Entra ID Users.

    2. Select Advanced options, then Edit attribute list for [your app name]. (If this option isn't available, first visit your Microsoft provisioning to enable the schema editor, then return to this page.)

    3. At the bottom of the attribute list, add a new attribute with the following details, then click Add Attribute:

      • Name: urn:ietf:params:scim:schemas:extension:fullstory:2.0:User:role

      • Type: String

      • Multi-value: No

    4. Click Save.

  2. Define app roles matching Fullstory's roles:

    1. Browse to Entra ID > App registrations > All applications, and select the same application you created for SCIM.

    2. Select App roles > Create app role.

    3. Create one role for each Fullstory role you want to support, setting Allowed member types to Users/Groups (Please note: The umbrella manager role is not supported via SSO role mapping or SCIM attributes):

      • Admin: admin

      • Architect: architect

      • Standard: standard

      • Explorer: explorer

      • Guest: guest

    4. Click Apply after each role.

  3. Map the role attribute (Please note: Assign only one app role per user. Microsoft Entra ID doesn’t guarantee which role is provisioned if a user is assigned more than one):

    1. Return to your provisioning app's Mappings > Provision Microsoft Entra ID Users.

    2. Click Add New Mapping.

    3. Set Mapping Type to Expression.

    4. Enter the expression: SingleAppRoleAssignment([appRoleAssignments])

    5. Set Target attribute to urn:ietf:params:scim:schemas:extension:fullstory:2.0:User:role.

    6. Set Apply this mapping to Always.

    7. Click Ok, then Save.

Assigning users and groups, and starting provisioning

  1. From your provisioning app, select Users and groups in the left panel, then Add user/group to assign the users or groups you want Microsoft Entra ID to provision to Fullstory. If you configured role mapping above, choose the matching role under Select a role for each assignment. (Please note: Microsoft Entra ID only provisions users and groups that are explicitly assigned the application. If you don’t assign anyone, nothing will be provisioned.)

  2. Select Overview in the left panel, then Start provisioning.

  3. Select Provisioning logs in the left panel to monitor progress.

Things to know about Microsoft Entra ID provisioning

  • Sync interval: After the initial provisioning cycle, Microsoft Entra ID checks for changes approximately every 40 minutes. This is normal behavior, not a sign of a broken connection. To provision a specific user immediately (for example, while testing), use Provisioning on-demand in the left panel of your provisioning app.

  • Assigned-only provisioning: Microsoft Entra ID only provisions users and groups you've explicitly assigned to the app, unlike some Okta configurations that can provision more broadly.

  • Deactivation, not deletion: As with Okta, when a user is unassigned or disabled in Microsoft Entra ID, Fullstory disables the corresponding user rather than deleting them. See "What happens to a user when they're deprovisioned via SCIM?" in the FAQs below.

By following these steps, you can successfully configure SCIM for your Fullstory organization, enabling automated user provisioning and deprovisioning through Microsoft Entra ID.

Managing Groups with SCIM 

SCIM lets you create, update, and delete user groups (and group membership) from your identity provider (IdP) directly into Fullstory. Instead of manually creating groups and adding members inside Fullstory, your IdP becomes the source of truth. When someone joins or leaves a group in your IdP, the change flows to Fullstory automatically. Once a group exists in Fullstory, you can assign it permissions on spaces. SCIM automates how those groups stay in sync with your organization's team structure.

Prerequisites

Before configuring SCIM Groups, confirm the following on the org where you want automated group management:

  • SSO is configured on this org. SCIM requires SSO as an upstream dependency. See How do I configure SSO? or How to configure Okta SSO.
  • SCIM user provisioning is active on this org. Your org must already have SCIM set up for user lifecycle management, as described earlier in this article.
  • At least one FGAC project is enabled on this org. Groups in Fullstory are introduced by enabling an FGAC project. See Fine-Grained Access Controls for Spaces and Groups for Fine-Grained Access Controls.
  • Group members are provisioned in your IdP. Any users you want included in a pushed group must already be provisioned and assigned to the Fullstory app in your IdP.
Multi-org customers: Each Fullstory org requires its own SSO connection, SCIM configuration, and FGAC enablement. If you have multiple orgs, repeat the upstream setup and the steps in this section for each org where you want automated group management.

Configure SCIM Groups with Okta

Okta doesn't support using the same group for both app assignment and Group Push. This is an Okta-level constraint, not a Fullstory limitation. If you currently use an Okta group to assign users to the Fullstory app (under the Assignments tab), you can't also push that same group to Fullstory under the Push Groups tab. Create a separate group with the same members and push that group instead. For more detail, see Okta's documentation on app assignments and Group Push.

  1. In the Okta Admin Console, navigate to Applications > Fullstory and confirm that provisioning is enabled under the Provisioning tab.
  2. Within the Fullstory app in Okta, click the Push Groups tab. This is where you configure which Okta groups flow to Fullstory.
  3. Click Push Groups and choose your push method:
    • Find groups by name: search for a specific Okta group and push it individually. Best for a small number of groups.
    • Find groups by rule: define a pattern matching on group name or description to push multiple groups at once. Best for many groups that follow a naming convention.
  4. For each group you select, Okta checks whether a matching group already exists in Fullstory:
    • If a match is found, click Link Group to connect the Okta group to the existing Fullstory group and hand membership control to Okta. Existing permission assignments on the group are preserved.
    • If no match is found, Okta creates a new group in Fullstory automatically.
  5. After selecting your groups, click through to push. Then, in Fullstory, go to Settings > Account Management > Groups. Your pushed groups appear with a SCIM-managed badge, and membership editing for those groups is disabled in the Fullstory UI.
  6. Assign permissions to your groups in Fullstory. SCIM manages who is in each group; Fullstory manages what each group can access. See Fine-Grained Access Controls for Spaces to assign space access to your groups. If you linked to existing groups, their permission assignments are already in place.

Fullstory's Okta integration uses a custom SAML app, so Okta sends PUT requests for all group updates, including name changes and membership changes. This means every group update includes the full group object—the name and complete membership list—rather than incremental add/remove operations. This is expected behavior and works correctly with Fullstory's SCIM endpoint; no action is needed on your part, but it's worth understanding if you're troubleshooting or monitoring SCIM traffic.

Configure SCIM Groups in Microsoft Entra ID

Microsoft Entra ID is also supported for SCIM Groups, using the same provisioning app you configured for user provisioning above.

  1. In your Fullstory provisioning app in Microsoft Entra ID, select Mappings and confirm Provision Microsoft Entra ID Groups is enabled (it's on by default unless it was previously turned off).

  2. Assign the groups you want to sync to Fullstory the same way you assign users: select Users and groups > Add user/group, then choose a group instead of an individual user.

  3. In Fullstory, go to Settings > Account Management > Groups. Groups pushed from Microsoft Entra ID appear with a SCIM-managed badge, and membership editing for those groups is disabled in the Fullstory UI.

  4. Assign permissions to your groups in Fullstory. See Fine-Grained Access Controls for Spaces to assign space access to your groups.

Please note: 

  • Group provisioning (create, update, and delete) requires a Microsoft Entra ID plan that supports application-based group assignment (Microsoft Entra ID P1 or higher). On plans that don't support this, group membership changes may not sync to Fullstory as expected.

  • Group display names must be unique within your Microsoft Entra ID tenant for group provisioning to work correctly. If two groups share a display name, rename one before assigning it to the Fullstory provisioning app.

Unlike Okta, Microsoft Entra ID sends incremental PATCH requests for group updates: separate operations for adding members, removing members, and renaming a group, rather than the full group object every time. This is standard SCIM behavior and works correctly with Fullstory's SCIM endpoint; no action is needed on your part.

What changes after configuration

Once SCIM Groups is configured:

  • SCIM-managed groups display a badge. In the Groups table under Settings, groups pushed from your IdP show a visual indicator that they're SCIM-managed.
  • Membership editing is disabled for SCIM-managed groups. You can't add or remove users from these groups directly in Fullstory—membership is controlled exclusively from your IdP, whether the group was created fresh by SCIM or was an existing group that SCIM took over via linking.
  • Groups not managed by SCIM remain editable. Any group that hasn't been linked to or created by SCIM stays fully under your control in Fullstory. You can manage membership manually, or take it over with SCIM later by linking it to an IdP group.
  • Group deletion flows from the IdP. If a group is deleted in your IdP, it's deleted in Fullstory. This is a permanent deletion, not an archive.

 

Frequently Asked Questions

Why is my group push returning an error?

Confirm that all prerequisites listed above are met: SSO must be configured, SCIM provisioning must be active, and the org must be on an Enterprise plan. If all prerequisites are met and the issue persists, contact your Fullstory account team.

Why aren’t my pushed groups appearing in Fullstory?

Check two things:

  1. Is SCIM provisioning still active? Confirm under Applications > Fullstory > Provisioning in Okta, or under Provisioning > Overview in Microsoft Entra ID.

  2. Are the users in those groups assigned to the Fullstory app in your IdP? Users who aren't assigned to the app won't appear in pushed groups, even if they're group members on the IdP side.  

If you're using Microsoft Entra ID, also confirm that provisioning has completed a sync cycle — new assignments can take up to about 40 minutes to appear. See "Things to know about Microsoft Entra ID provisioning" above.

What if a group I want to push is already used for app assignment?

Create a separate group with the same members and push that instead. Okta doesn't allow the same group to be used for both app assignment and Group Push. See app assignments and Group Push. 

Why hasn't a user I just assigned shown up in Fullstory yet?

If you're using Microsoft Entra ID, provisioning runs on a cycle rather than firing the moment you assign a user: the first sync can take a while depending on how many users are in scope, and later syncs run about every 40 minutes. To provision a specific user immediately for testing, use Provisioning on-demand in your Microsoft Entra ID provisioning app. If you're using Okta, provisioning is near-immediate, so check that the user is assigned to the Fullstory app and that Test Connector Configuration still passes. 

What happens to a user when they're deprovisioned via SCIM?

Some identity providers implement deprovisioning differently. When Microsoft Entra ID deprovisions a user, the user can be either disabled or deleted from Fullstory. In contrast, when Okta deprovisions a user, the user’s status is updated to disabled. Disabled members can't log in to your Fullstory account and don't count toward your user quota. Once a user is disabled in Fullstory, they can be manually deleted.

What happens if I remove a user from a group in my IdP?

The membership change syncs to Fullstory automatically. The user loses whatever access that group provided.

Do I need to reconfigure my existing SCIM integration to use SCIM Groups?

No. SCIM Groups builds on top of your existing SCIM user provisioning. You don't need to change your SCIM connection settings, regenerate tokens, or re-provision users—you're adding group push to what's already there.

Can I update a user's email address via SCIM?

Fullstory's username is your user's email address, and SCIM doesn't currently support renaming a user's username or email. 

What if I’m using an identity provider not mentioned here?

Using a different identity provider? SCIM is an open standard, and Fullstory's SCIM API implements the standard /Groups endpoints. Identity providers other than Okta and Microsoft Entra ID that support SCIM group provisioning should work in principle, though our endpoint is built and tested against Okta's and Microsoft Entra ID's implementations. Consult your IdP's documentation for how to configure group provisioning via SCIM, and reach out to your Fullstory account team if you run into issues. 

Was this article helpful?

Articles in this section

See more

Got Questions?

Get in touch with a Fullstory rep, ask the community or check out our developer documentation.

Technical Support Support
Ask the Community Community
Dev Docs Dev Docs