Skip to content

Directory Sync

  • Managed deployment
  • Self-hosted

Directory Sync uses SCIM 2.0 to provision and update Personal Accounts, Teams, and Team membership from your identity provider (IdP). It is available for managed and self-hosted deployments.

How Directory Sync Works

Your IdP sends user and group changes to the SCIM endpoint for your Qualytics instance. A restricted Service Token authenticates each request.

How Access Maps

  • SCIM users become Qualytics Personal Accounts. Unless you configure role mapping, newly provisioned users receive the Member role.
  • SCIM groups become Qualytics Teams, and group changes update Team membership.
  • Datastore assignments and Team permissions remain managed in Qualytics.

Test the group lifecycle

Deleting a group in your IdP can delete the matching Team in Qualytics and affect access to its assigned datastores. Test provisioning and deletion with a limited group before enabling Directory Sync broadly.

Choose one Team membership strategy

Directory Sync manages the full user and group lifecycle. Self-hosted deployments using OIDC can instead use just-in-time group sync, which only adds Team membership at sign-in and never removes it.

If both methods are enabled, sign-in mapping can add a membership that Directory Sync previously removed. Choose one method as the source of Team membership.

Requirements

Before configuring Directory Sync, you need:

  • Administrator access to your IdP
  • An IdP application or integration that supports SCIM 2.0
  • A Qualytics Service User with the Admin role
  • A Service Token with SCIM Administration Token selected
  • Network access from your IdP to your Qualytics instance

For a dedicated integration identity, create a Service User, then generate a Service Token.

Self-hosted requirements

Directory Sync requires API token authentication and a Qualytics API URL that your IdP can reach. If your deployment rejects API tokens or uses a private endpoint that your IdP cannot reach, contact Qualytics Support before continuing.

Use the same user identifier for Directory Sync and OIDC sign-in. If your IdP sends different identifiers for SCIM and OIDC, contact Qualytics Support before enabling sync.

Configure Directory Sync

  1. Create the dedicated Service User and restricted Service Token in Qualytics.
  2. In your IdP, set the SCIM base URL to https://<your-Qualytics-domain>/api/scim/v2.
  3. Enter the Service Token as the bearer token.
  4. Assign the users and groups that the IdP should provision.
  5. Test the connection, enable provisioning, and monitor the first synchronization.

Benefits

  • Automated provisioning: Create, update, and deactivate users from your IdP.
  • Consistent Team membership: Keep Qualytics Teams aligned with IdP groups.
  • Reduced manual work: Apply user and group changes through one identity-management workflow.
  • Restricted authentication: Limit the integration token to SCIM administration.

Supported Providers

Qualytics supports SCIM 2.0 user and group provisioning and has been verified with the following providers. Contact Qualytics Support before configuring an unlisted provider.

  • MS Entra Microsoft Entra

    Microsoft Entra user and group provisioning with SCIM 2.0.

    Setup Guide

  • Okta Okta Okta

    Okta identity management with OAuth Bearer Token-based SCIM provisioning.

    Setup Guide

  • OneLogin OneLogin

    OneLogin SCIM Provisioner with SAML for automated user and group management.

    Setup Guide

  • JumpCloud JumpCloud

    JumpCloud SCIM provisioning within existing SAML applications.

    Setup Guide