SCIM keeps your Tines 3B tenant in sync with your identity provider (IdP). Once it's set up, your IdP creates, updates, and deactivates users. It also manages group memberships in real time, so you're not inviting people or editing groups by hand.
This article walks you through enabling SCIM on your SSO provider, connecting your IdP, and understanding how sync behaves.
Note: You'll need admin access to configure SSO. If you don't see the settings described below, ask an admin on your team.
SCIM in Tines 3B is a sync mode on an existing SSO provider, so you'll set up single sign-on first. Tines 3B supports SCIM 2.0 with two resource types:
A few things worth knowing up front:
SSO comes first. You configure SCIM with either an OIDC or SAML provider.
SCIM users sign in through SSO. In SCIM mode, a user has to be provisioned by your IdP before they can sign in. Accounts aren't created on first login.
You need two values from Tines 3B, both of which Tines 3B gives you during setup:
A base URL
A bearer token
To get started, go to Settings, then Single sign-on. If you haven't set up a provider yet, add one by choosing a protocol (OIDC or SAML) and filling in the details from your IdP. If you already have a provider, select it to edit it.
Read how to set up SSO here.
Choose SCIM as your sync mode
Every SSO provider has a Sync mode setting with four options:
Off. You invite users and manage group memberships manually in the app.
JIT - users only. Accounts are created on first SSO login; you manage groups manually.
JIT - users and groups. Accounts are created on first login, and group memberships sync each login from your IdP's "groups" claim.
SCIM. Your IdP provisions users and groups over SCIM 2.0 in real time.
If you select SCIM. Two things appear:
A SCIM 2.0 base URL you'll copy into your IdP.
A short summary of how sync applies changes (covered below).
Copy your base URL and generate a token
Copy the SCIM 2.0 base URL shown in the settings. This is the SCIM endpoint (sometimes called the "tenant URL") you'll enter in your IdP. It ends in /scim/v2.
When you save the provider with SCIM selected, Tines 3B mints a bearer token and shows it to you once in a dialog:
Note: Copy this token now, it won't be shown again.
Copy the token and store it somewhere safe, like your IdP's SCIM configuration or a secrets manager. If you lose it and you can't retrieve it, you'll need to revoke it and generate a new one. Tokens begin with 3b_scim_.
Connect your identity provider
In your IdP's provisioning settings, enter:
The SCIM endpoint. The base URL you copied, ending in
/scim/v2.The authentication method. OAuth Bearer Token.
The token. The
3b_scim_token Tines 3B showed you.
The exact screens differ by IdP, so follow your provider's own SCIM setup guide (for example, Okta or Microsoft Entra ID) for where these fields live. Once connected, your IdP will begin pushing users and groups to Tines 3B.
Tines 3B publishes standard SCIM 2.0 discovery endpoints (ServiceProviderConfig, Schemas, and ResourceTypes), so most IdPs can confirm what's supported automatically. For reference, Tines 3B supports PATCH and filtering, and does not support bulk operations, sorting, password changes, or ETags.
How sync applies changes
SCIM provisioning in Tines 3B follows a few deliberate rules. Keep these in mind so the app's picture matches your IdP's:
Users must exist before they sign in. Provisioning a user creates their account and a personal space. Until your IdP provisions someone, they can't sign in.
Deactivating removes access. When your IdP sets a user to inactive (or deletes them), Tines 3B deactivates the account and revokes their sessions. Tines 3B won't let you deactivate the last remaining admin.
Taking over an existing group. If your IdP provisions a group whose name already exists, say, one you created in the app, Tines 3B adopts that group. Its members are replaced with exactly the set from your IdP, while its existing access assignments to spaces, apps, and other resources are kept.
Groups that grant access can't be deleted. A group can't be removed while it still grants access to any resource. Remove those assignments first, then delete the group.
Note: Any groups created not from SCIM and not adopted with the SCIM configuration would not be able to be deleted in-app when SCIM is enabled. It is important to clean-up your groups before SCIM enablement or know they will need to disable SCIM to clean up old groups
Keeping your token healthy
SCIM tokens are valid for 365 days. The settings show the expiry date, and the warning turns red once you're within 30 days, or once the token has expired. An expired token stops sync until you replace it.
To replace or turn off a token, use Revoke token. Revoking invalidates the token immediately and sets the provider's sync mode back to Off. To start again, select SCIM as the sync mode once more and Tines 3B will generate a fresh token.
Tines 3B rate-limits SCIM traffic at 3,000 requests per minute, comfortably above a normal bulk sync. If your IdP exceeds it, Tines 3B returns a 429 with a Retry-After header, and well-behaved IdPs back off automatically.
Every SCIM change Tines 3B makes is recorded in your audit log, so you can trace exactly what your IdP provisioned and when.