Limitations & Considerations

axe's SCIM implementation covers user lifecycle and product-access management. This page describes behaviors and boundaries to plan for, so your team knows what SCIM handles automatically and what remains a manual or in-product step.

Admin roles are not managed via SCIM

SCIM adds users as regular members with standard product access. It does not assign administrative roles. The following are configured in the axe Account Portal or within the product, not through SCIM:

• Enterprise admin — organization-wide administrator of your axe Account enterprise.
• Product-level admin — for example, axe Monitor Admin, axe Reports Admin, axe Auditor Admin, and axe DevTools Mobile Admin.

If your provisioning process requires administrators, plan a manual step to grant those roles in the Portal after the user is provisioned.

One related SCIM safeguard: SCIM will not deprovision the last remaining enterprise admin. This prevents accidentally locking your organization out.

Deprovisioning is a soft removal

Deprovisioning a user (active: false) or issuing a delete removes the user from your enterprise — revoking their access and freeing their seats. It does not permanently delete the user's underlying sign-in account.

• Access is revoked immediately.
• The account record is retained, so the user can be reactivated later without losing their history.
• This satisfies typical compliance and audit requirements, since access is fully revoked while user history is preserved.

Product access vs. in-product configuration

SCIM grants product access (a seat) and manages team membership. It does not configure what a user can do inside a product. For example, in axe Monitor:

• SCIM grants the axe Monitor seat and manages team membership.
• Assigning a team access to specific scans or scan groups is done inside axe Monitor.
• Scan-level roles (Scan Admin, Scan Member, Viewer) are assigned inside axe Monitor.

Group behavior notes

• Product subscriptions cannot be created or deleted via SCIM — only membership (seats) is managed. A delete request against a subscription group is ignored.
• Teams can be created and deleted via SCIM.
• Replacing a group's members with an empty set removes all members.
• Updating a group via PUT is not supported (405 Method not allowed); use PATCH to modify membership.

Summary

Next

• Troubleshooting
• Overview