--- title: Set up SCIM provisioning description: Let your identity provider create, update, and deactivate BriefCatch accounts automatically, and map provisioned groups to BriefCatch roles. --- [Skip to content](https://support.briefcatch.com/home/web-app/scim#main-content) [![briefcatchlogo](https://support.briefcatch.com/hs-fs/hubfs/briefcatchlogo.png?width=213&height=35&name=briefcatchlogo.png)](https://www.briefcatch.com/) - [Support Home](https://support.briefcatch.com/home) - [Submit a Support Request](https://support.briefcatch.com/home/kb-tickets/new) Open main navigation Close main navigation - [Support Home](https://support.briefcatch.com/home) - [Submit a Support Request](https://support.briefcatch.com/home/kb-tickets/new) Hello. How can we help you? - There are no suggestions because the search field is empty. 1. [Support Hub](https://support.briefcatch.com/home?hsLang=en) 2. [Manage Your Account](https://support.briefcatch.com/home/manage-your-account?hsLang=en) 3. [Identity & SSO](https://support.briefcatch.com/home/manage-your-account?hsLang=en#identity-sso) # Set up SCIM provisioning ## Let your identity provider create, update, and deactivate BriefCatch accounts automatically, and map provisioned groups to BriefCatch roles. **Goal:** hand user lifecycle to your identity provider. With SCIM in place, the BriefCatch member list becomes a reflection of your directory rather than something you maintain by hand. ### Step 1: Review prerequisites - **Your role is admin or owner.** - **Your plan includes enterprise SCIM.** - **Single sign-on is already connected.** Until it is, the SCIM screen shows **“Connect SSO before setting up SCIM”** and leaves the token and mapping controls disabled. See [Set up single sign-on](https://support.briefcatch.com/home/web-app/sso?hsLang=en). - **You can administer your identity provider’s provisioning settings.** ### Step 2: Create a SCIM token Go to **Settings → Security → SCIM** and create a token. The token is shown **once**, in a dialog titled **“Save this SCIM token now.”** Copy it into your identity provider or your secret manager before closing that dialog. If you lose it, you cannot retrieve it — you create a new one and update your provider. Treat the token as a credential with directory-level reach. Never send it over email or chat, and never paste it into a support ticket. BriefCatch support will not ask you for it. ### Step 3: Point your identity provider at BriefCatch In your provider’s provisioning configuration, supply: - **The SCIM base URL**, which is your BriefCatch API host followed by **`/api/v1/scim/v2`**. Note the `/api/v1` — a URL ending in just `/scim/v2` will not reach the service. If you are not certain which API host your organization is on, ask BriefCatch support rather than guessing; a wrong base URL usually surfaces as an authentication failure, which points you at the token instead of the address. - **The token** from step 2, as the bearer token. BriefCatch implements **SCIM 2.0** and publishes the standard discovery endpoints (`ServiceProviderConfig` and `Schemas`), so most providers can validate the connection themselves before you push any users. Supported user operations: create, list, read, update, replace, and deactivate. ### Step 4: Map groups to roles Provisioned groups are mapped to a BriefCatch **Organization role**: **Member** or **Admin**. Mapping by group rather than by person is the point. Someone joins the group in your directory and gets the matching BriefCatch role automatically; they leave the group and lose it. The mapping panel shows provisioned groups as **“Managed by the connected identity provider”**, because their membership belongs to your directory rather than to BriefCatch. The **owner** role is deliberately not a SCIM mapping target. Ownership carries billing and destructive account actions, and it stays a decision made inside BriefCatch. See [Roles and permissions](https://support.briefcatch.com/home/web-app/roles-and-permissions?hsLang=en). #### Step 5: Verify with one user before syncing everyone Provision a single test user and confirm they appear in BriefCatch with the expected role, then let the full sync run. This is the same reasoning as the SSO test sign-in: a mapping mistake caught on one account is an edit, and the same mistake caught after a full sync is a cleanup. ### Guardrails you may run into BriefCatch refuses directory operations that would leave the organization in an unusable state: - **An organization cannot lose its last owner.** A deprovisioning request that would remove the only owner is rejected. Transfer ownership inside BriefCatch first. - **Inactive organizations do not accept provisioning.** - **Users outside your organization’s scope are rejected**, so a misconfigured provider cannot reach into accounts that are not yours. These are refusals, not errors to retry. Each means the request would have broken something. ### Important notes - **SCIM does not replace SSO.** Provisioning creates and maintains accounts; SSO authenticates them. You need both for a directory-managed deployment. - **The token is per organization.** If you administer more than one, each needs its own. - **Deprovisioning cuts access.** Confirm any document handoff before removing someone from the mapped group. See [Teams and organizations](https://support.briefcatch.com/home/web-app/teams-and-organizations?hsLang=en).   - [Get Started](https://support.briefcatch.com/home/get-started?hsLang=en#main-content) - [Product Overviews](https://support.briefcatch.com/home/get-started?hsLang=en#product-overviews) - [Install & Sign In](https://support.briefcatch.com/home/install-sign-in?hsLang=en#main-content) - [System Requirements](https://support.briefcatch.com/home/install-sign-in?hsLang=en#system-requirements) - [Install it Yourself](https://support.briefcatch.com/home/install-sign-in?hsLang=en#install-it-yourself) - [Deploy for Your Firm](https://support.briefcatch.com/home/install-sign-in?hsLang=en#deploy-for-your-firm) - [Sign In & Accounts](https://support.briefcatch.com/home/install-sign-in?hsLang=en#sign-in-accounts) - [Update & Uninstall](https://support.briefcatch.com/home/install-sign-in?hsLang=en#update-uninstall) - [Use BriefCatch](https://support.briefcatch.com/home/use-briefcatch?hsLang=en#main-content) - [Format](https://support.briefcatch.com/home/use-briefcatch?hsLang=en#format) - [Refine](https://support.briefcatch.com/home/use-briefcatch?hsLang=en#refine) - [Verify (RealityCheck)](https://support.briefcatch.com/home/use-briefcatch?hsLang=en#verify-realitycheck) - [Learn](https://support.briefcatch.com/home/learn?hsLang=en) - [Manage Your Account](https://support.briefcatch.com/home/manage-your-account?hsLang=en#main-content) - [Users, Teams & Settings](https://support.briefcatch.com/home/manage-your-account?hsLang=en#users-teams-settings) - [Identity & SSO](https://support.briefcatch.com/home/manage-your-account?hsLang=en#identity-sso) - [Admin Portal & AI Controls](https://support.briefcatch.com/home/manage-your-account?hsLang=en#admin-portal-ai-controls) - [Billing, Plans & Credits](https://support.briefcatch.com/home/manage-your-account?hsLang=en#billing-plans-credits) - [Troubleshoot](https://support.briefcatch.com/home/troubleshoot?hsLang=en#main-content) - [Product FAQs](https://support.briefcatch.com/home/troubleshoot?hsLang=en#product-faqs) - [Trust & Security](https://support.briefcatch.com/home/trust-security?hsLang=en) - [Legacy Products](https://support.briefcatch.com/home/legacy-products?hsLang=en#main-content) - [BriefCatch 3](https://support.briefcatch.com/home/legacy-products?hsLang=en#briefcatch-3) - [WordRake](https://support.briefcatch.com/home/legacy-products?hsLang=en#wordrake) [![briefcatch-logo-white](https://support.briefcatch.com/hubfs/briefcatch-logo-white.svg "briefcatch-logo-white")](https://www.briefcatch.com/) Copyright © 2026, LawCatch, Inc. [Submit a Support Request](https://support.briefcatch.com/home/kb-tickets/new?hsLang=en)