SCIM Provisioning in Zoho Vault

SCIM Provisioning

System for Cross-Domain Identity Management (SCIM) enables automatic provisioning and de-provisioning of users and groups in your Zoho Vault organization directly from your Identity Provider (IdP).

Zoho Vault provides a SCIM-compliant endpoint that accepts requests from any compatible IdP. Once configured with a valid SCIM API key, your IdP becomes the single source of truth for managing access, eliminating the need for manual user administration in Zoho Vault.

Zoho Vault SCIM automates the following operations:

  1. Create Users: Automatically provisions a Zoho Vault account when a user is added or assigned in your IdP.
  2. Update Attributes: Keeps user profiles in sync by pushing changes to name, email, department, and other mapped fields to Zoho Vault in real time.
  3. Send Welcome Email: Emails newly provisioned users with everything they need to access Zoho Vault for the first time.
  4. Require Password Change: Prompts users to set a new password on their first login, ensuring initial credentials are replaced immediately.
  5. Deactivate / Delete Users: Instantly revokes access when a user is deactivated or removed in your IdP, eliminating the risk of orphaned accounts.
  6. Group Provisioning: Mirrors groups and their memberships from your IdP, so team-based access policies in Zoho Vault always stay current.
Notes
Note:
This article covers SCIM-based provisioning. Zoho Vault also supports the following methods for adding users to your organization:
 Manual Invitation: Send email invitations directly to team members, who then join by accepting the invite.
 Directory Integration: For organizations using identity providers such as Active Directory, AD/LDAP, Microsoft Entra ID, or Okta, users can be imported and synced via directory integration.
 Cloud App Import: If your organization uses Google Workspace or Microsoft 365, you can import users directly from those platforms.
 CSV File Import: Upload a CSV file to add multiple users in bulk.

Setting up SCIM 

To connect your IdP to Zoho Vault via SCIM, you will need two values: a SCIM Base URL and an API Key. These credentials authorize your IdP to make provisioning requests to the Zoho Vault server.

To retrieve your SCIM credentials:
  1. Log in to Zoho Vault as an administrator.
  2. Navigate to Settings, then select SCIM Configuration.
  3. Copy the SCIM Base URL and API Key.
  4. Enter these values in the SCIM configuration section of your IdP.
Once saved in your IdP, provisioning will begin automatically based on the assignments and rules you configure there.

Setting up OAuth

  1. Register your client in the Zoho API Console.
  2. Add the scopes the client needs from the table below.
Scope
What it allows
ZohoVault.SCIM.Read
Permission to query and read user/group profiles from the SCIM
ZohoVault.SCIM.Create
Permissions to create new users/groups
ZohoVault.SCIM.Update
Permissions to update existing users/groups existing user attributes
ZohoVault.SCIM.Delete
Permissions to delete users/groups
ZohoVault.SCIM.ALL
Permissions to fully manage user and group identities

Required attributes 

Zoho Vault uses standard SCIM v2 attribute names. Since each IdP may label attributes differently, your IdP will map its own fields to these standard names during the provisioning process.

User attributes 

For each user, Zoho Vault will use the following attributes:
  1. Active - A boolean indicating if the user is active. The default is true.
  2. userName (required) - A unique identifier for the user.
  3. Id - A unique identifier for a SCIM resource, such as a user, that is defined by Zoho Vault.