Configuring Your Identity Provider

This page is not available in the language you requested. You have been redirected to the English version of the page.
Link to this page copied to clipboard
Not for use with personal data

Configuring Your Identity Provider

This page describes how to connect your identity provider's SCIM connector to axe. The exact steps vary by provider, but the settings are the same.

Before you begin, make sure you have completed the Prerequisites & Setup: a SCIM subscription, SSO configured, your base URL, and your SCIM API key.

Connection settings

Configure your SCIM connector with the following:

Setting Value
SCIM base URL https://<your-base-url>/api/scim/v2
Authentication API key (bearer / header token)
Token Your SCIM API key
Token header Authorization: <API_KEY> or X-API-Key: <API_KEY>

Attribute mapping

Map your identity provider's user attributes to axe:

axe attribute Source
userName User's work email
emails[].value (primary) User's work email
name.givenName First name
name.familyName Last name
externalId Your directory's unique user identifier (recommended)

Mapping externalId to your directory's stable identifier is recommended — it allows axe to reliably match users across syncs.

tip

Some connectors (for example, SailPoint) attempt to validate the full SCIM schema during setup. If your connector offers a "Non-Compliant Server" (or "relaxed") option, enabling it skips that validation step. axe does expose the standard discovery endpoints (/ServiceProviderConfig, /Schemas, /ResourceTypes), so try the connection without this option first — enable it only if your connector's test connection or schema discovery fails while authentication succeeds.

Provider-specific notes

Okta

  • Create a SCIM 2.0 application (or use the provisioning tab of your existing app).
  • Set the SCIM connector base URL and API key as above.
  • Okta uses the user's email as the unique identifier.

Microsoft Entra ID (Azure AD)

  • In your enterprise application, open Provisioning and set the mode to Automatic.
  • Enter the base URL as the Tenant URL and the API key as the Secret Token.
  • Entra sends the directory Object ID as externalId; ensure it is mapped.

SailPoint (IdentityIQ / Identity Security Cloud)

  • Configure a SCIM 2.0 source with API token authentication.
  • Enter the base URL and API key.
  • Enable the "Non-Compliant Server?" option to skip schema discovery (only /Users and /Groups are required).

Validating the connection

After configuring the connector, validate the integration in this order:

  1. Test connection — confirm authentication succeeds.
  2. Read groups — confirm your product subscriptions and teams appear (GET /Groups).
  3. Create a test user — provision a single user and confirm they appear in axe and receive the invitation email.
  4. Assign a product — add the user to a subscription group and confirm they receive a product seat.
  5. Deactivate the test user — confirm access is revoked.

If any step fails, see Troubleshooting.

Next

Is this page helpful?

Help us improve this page

Still need help?