How do you provision Workload users from an IdP?
Business+: SSO + JIT (allow-listed email domains) creates membership on first login. Enterprise: SCIM 2.0 Users at /api/scim/v2 with Bearer token (create, list, soft-disable). Nested SCIM Groups are not supported yet.
SCIM & JIT
for Enterprise IT
Provision from your IdP without manual invites — honest scope for security reviews.
Frequently Asked Questions
Nested AD SCIM Groups?+
Not in v1. Only SCIM Users (create/list/patch active) ship today. Nested Groups = P3 backlog.
Does soft-disable remove access?+
Yes. Patch active=false sets disabledAt on the membership; the user can no longer access the org.
Where is the runbook?+
Settings → SCIM card (base URL /api/scim/v2, Bearer, supported ops) plus training/docs links.