How SCIM works in Probo
- Create user — When you assign a user to the Probo app in your IdP, Probo creates their profile and membership automatically.
- Update user — Changes to a user’s name, title, department, or other attributes in your IdP are synced to Probo.
- Deactivate user — Removing a user from the Probo app in your IdP deactivates their Probo profile and revokes access.
SCIM only manages users provisioned through SCIM. Users created manually or via SAML SSO are not affected by SCIM sync operations.
Before you start
- You need the Owner role in your Probo organization.
- Your identity provider must support SCIM 2.0 (Okta, Azure AD, Google Workspace, JumpCloud, and most enterprise IdPs do).
Setting up SCIM
Create the SCIM configuration
Navigate to Settings → Security → Provisioning and click Enable SCIM.Probo generates a SCIM token and displays your SCIM endpoint URL. Copy both — the token is only shown once.
Note your SCIM endpoint
Your SCIM base URL is:Enter this as the SCIM base URL in your identity provider.
Configure your identity provider
In your IdP’s SCIM integration settings, enter:
Refer to your IdP’s documentation for exact configuration steps.
| Setting | Value |
|---|---|
| SCIM base URL | https://app.getprobo.com/api/connect/v1 |
| Authentication method | HTTP Header |
| Authorization header | Bearer <your-scim-token> |
| Supported operations | Create, Update, Deactivate |
Supported SCIM attributes
Probo accepts the following SCIM user attributes:| SCIM attribute | Probo profile field |
|---|---|
userName | Username |
displayName | Full name |
emails[primary].value | Email address |
active | Profile state (active / inactive) |
title | Position |
userType | Profile kind |
name.givenName | Given name |
name.familyName | Family name |
nickName | Nickname |
locale | Locale |
timezone | Timezone |
preferredLanguage | Preferred language |
enterprise.employeeNumber | Employee number |
enterprise.department | Department |
enterprise.costCenter | Cost center |
enterprise.organization | Enterprise organization |
enterprise.division | Division |
enterprise.manager.value | Manager reference |
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.
Regenerating the SCIM token
If your SCIM token is compromised or you need to rotate it:SCIM bridge for Google Workspace
If you use Google Workspace, Probo supports a SCIM bridge that syncs your directory automatically without requiring Google Workspace’s native SCIM support. To configure the SCIM bridge:- Connect your Google Workspace account under Settings → Integrations → Google Workspace.
- Navigate to Settings → Security → Provisioning → Bridge.
- Optionally, add usernames to the Excluded usernames list to prevent those accounts from being synced.
SCIM events log
Every SCIM request your identity provider makes to Probo is logged. Use the events log to troubleshoot provisioning issues.Review events
Each entry shows:
| Field | Description |
|---|---|
| Method | HTTP method (POST, PUT, PATCH, DELETE) |
| Path | SCIM resource path (e.g. /Users/...) |
| Status code | HTTP response code |
| Username | The user the operation targeted |
| IP address | Source IP of the IdP request |
| Error message | Details if the operation failed |
| Timestamp | When the event occurred |
Deleting the SCIM configuration
To remove SCIM provisioning, navigate to Settings → Security → Provisioning and click Delete configuration. Existing users provisioned via SCIM remain in Probo but will no longer be synced.SSO with SAML
Combine SCIM provisioning with SAML single sign-on.
Roles and permissions
Understand what each role can do in Probo.