Skip to main content

How to Set Up SCIM Integration in Sally AI

SCIM (System for Cross-domain Identity Management) lets you automatically connect Sally with your Identity Provider (IdP). This way, users and groups are always kept in sync without manual updates.


Quick Navigation

  1. What is SCIM and why use it with Sally AI?
  2. How do I set up SCIM in Sally AI?
  3. Where do I enter SCIM credentials in my IdP?
  4. What is the final configuration step in Sally?
  5. FAQ: SCIM in Sally

1. What is SCIM and why use it with Sally AI?​

SCIM is an open standard for user and group provisioning. It allows you to automatically transfer account information from your Identity Provider to Sally.

Instead of manually creating, updating, or removing users, SCIM ensures that:

  • New employees get access to Sally immediately.
  • Existing user details stay up to date.
  • Users who leave your company lose access automatically.

By connecting once through SCIM, your IdP becomes the single source of truth. Groups and licenses can still be managed centrally in your IdP, while Sally always reflects the latest state. This reduces admin overhead, prevents mistakes, and ensures secure, consistent access for your team.

2. How do I set up SCIM in Sally AI?​

  1. In Sally, go to Settings.

    Navigate to settings
    Step 1: Go to Settings

  2. Go to Users.

  3. Under the Management section, click on SCIM Integration.

    Open SCIM Integration
    Step 2: Open SCIM Integration in the User Administration tab

  4. Select your SCIM client and click Set up SCIM.

    Available integrations
    • Microsoft Entra (Azure AD)
    • Google Workspace
    • Okta
    • OneLogin
    • PingOne

    Select SCIM provider
    Step 3: Select your identity provider and start setup

  5. Sally generates your Tenant URL and Token. Make sure to copy these credentials right away, as you will need them to finish the setup inside your Identity Provider.

    Sally SCIM integration screen showing generated Tenant URL and Token to copy
    Copy the Tenant URL & Token to use in your IdP
    Continue in your IdP

    Now it's time to enter these credentials in your Identity Provider.
    Jump directly to the instructions for your tool:

3. Where do I enter SCIM credentials in my IdP?​

Until this step is done, groups won't appear in Sally, since the IdP hasn't started syncing yet.

3.1 Microsoft Entra (Azure AD)​

Follow these steps to connect Sally via SCIM in Microsoft Entra:

  1. In the Azure portal, go to "Enterprise Applications" and click on "+ New application".

    Create new application
    Step 1: Create a new Enterprise Application

  2. Select "Create your own application".

    Create your own application
    Step 2: Start creating your own application

  3. Give the app a name (e.g., Sally AI SCIM Integration) and choose "Integrate any other application you don't find in the gallery (Non-gallery)". Then click Create.

    Name the application
    Step 3: Name the application and select non-gallery integration

  4. Once the application is created, open it and go to Provisioning.

    Microsoft Entra enterprise application with the Provisioning menu opened
    Step 4: Navigate to the Provisioning menu

  5. Click on "+ New configuration".

    Add new configuration
    Step 5: Start a new provisioning configuration

  6. In the new configuration screen, enter the Tenant URL and Secret Token you copied from Sally. Click "Test connection" and then Create.

    Enter Tenant URL and Token
    Step 6: Add credentials from Sally and test the connection

  7. After the configuration is created, you can now assign groups to this profile.

    Note

    Only groups are supported for provisioning to Sally, not single users.


  1. Finally, start the provisioning by clicking on "Start provisioning".

    Microsoft Entra provisioning page with the 'Start provisioning' button highlighted
    Step 8: Enable provisioning to start syncing groups to Sally

  2. After provisioning has started, return to Sally and complete the setup by assigning the correct groups and licenses. You can find the detailed instructions in Final step in Sally.

3.2 Google Workspace​

  1. Open Admin Console → Apps → Web and mobile apps.
  2. Add a new custom SCIM app.
  3. Enter Tenant URL and Token.
  4. Assign groups for provisioning.
  5. After provisioning has started, return to Sally and complete the setup by assigning the correct groups and licenses. You can find the detailed instructions in Final step in Sally.

3.3 Okta​

  1. Go to Applications → select your Sally app.
  2. Open Provisioning tab.
  3. Enter Tenant URL and Token.
  4. Enable provisioning features (create, update, deactivate users).
  5. After provisioning has started, return to Sally and complete the setup by assigning the correct groups and licenses. You can find the detailed instructions in Final step in Sally.

3.4 OneLogin​

  1. Navigate to Apps → SCIM Provisioning.
  2. Paste Sally's Tenant URL and Token.
  3. Map groups and save.
  4. After provisioning has started, return to Sally and complete the setup by assigning the correct groups and licenses. You can find the detailed instructions in Final step in Sally.

3.5 PingOne​

  1. Go to Connections → Provisioning.
  2. Add a new SCIM connection.
  3. Provide Tenant URL and Token.
  4. Test and activate.
  5. After provisioning has started, return to Sally and complete the setup by assigning the correct groups and licenses. You can find the detailed instructions in Final step in Sally.

4. What is the final configuration step in Sally?​

After you have added the Tenant URL and Token to your Identity Provider and started the provisioning, the connection between your IdP and Sally is live.

Now it's time to finish the setup inside Sally by defining which groups and licenses should be used. This ensures that users synced from your IdP get the correct role and license automatically.

Sally lets you assign multiple IdP groups per role and per license tier. You don't have to merge everything into one big umbrella group: you can map several groups from your IdP to the same category and even combine categories (for example, the same group can activate users as standard users AND grant them a Pro license).

Follow these steps:

  1. Open SCIM Integration again.

  2. Under Group assignment, map your IdP groups to Sally roles:

    info
    • Active Sally user groups → Select one or more groups whose members should get access as standard users.
    • Admin user groups → Select one or more groups whose members should have administrator rights in Sally.

  1. Under License assignment, link IdP groups to specific license types (Starter, Pro, Enterprise). You can pick multiple groups per license tier, so membership in any of them controls which license users receive in Sally.

    Important

    If the selected groups combined contain more users than the number of available licenses, Sally will automatically purchase additional licenses.
    These licenses are billed immediately, so make sure your group sizes align with your subscription plan.

  2. Decide whether new users should receive an automatic invitation.

  3. Click Save to apply the configuration.

Sally SCIM Integration settings with multi-select fields for user groups, admin groups, and license tiers
Pick one or several groups per role and license tier, then save your configuration
  1. After saving, all members provisioned via SCIM will appear in your user list in Sally.
Recommendation: How to structure your groups

Because Sally supports multiple groups per category, you don't need one oversized group for the whole company. A few patterns that work well in practice:

  • Group by department or team. Keep separate IdP groups for Sales, Marketing, Support, etc. Assign all of them as Active Sally user groups and, if they all use the same license, also as the matching license group. Adding a new team later is just a new group, not a new configuration.
  • Use a dedicated admin group. Keep Sally admins in a small, focused group (e.g. Sally Admins or IT Leads). Members of that group get admin rights on top of their regular user role.
  • Model license tiers as explicit groups. Create IdP groups like Sally Starter, Sally Pro, Sally Enterprise. Upgrading a user is then a single membership change in your IdP, with no changes needed in Sally.
  • Combine both approaches. Use departmental groups to control who gets access, and a smaller tier group (e.g. Sally Pro) on top to upgrade selected power users to a higher license.

The more granular your groups, the easier it is to change access or licenses later, entirely from within your IdP.

SCIM Sally AI user list
List of user

5. FAQ: SCIM in Sally​

5.1 What happens if there are more users in a group than available licenses?​

If the groups assigned to a license tier contain, in total, more users than you currently have licenses for, Sally will automatically purchase additional licenses.
These licenses are billed immediately to ensure all users get access.

5.2 How does license priority work if a user is in multiple groups?​

When a user belongs to multiple SCIM license groups, Sally will always assign the lowest license tier.
For example: if a user is in both the Starter group and the Pro group, the user will only receive a Starter license.

5.3 Can I assign single users instead of groups?​

No. SCIM provisioning in Sally works exclusively with groups from your Identity Provider.
This ensures consistency and avoids manual exceptions.

5.4 Do I need to reconfigure SCIM if new groups are added in my IdP?​

No. As long as SCIM is active, any new groups created in your Identity Provider can be added directly in Sally under Group assignment or License assignment without restarting the setup. You can map as many groups as you need per category, so new teams or license tiers only require picking them in the multi-select.

5.5 How often does the sync run?​

Provisioning runs automatically in cycles (based on your IdP's schedule). In Microsoft Entra, for example, provisioning typically runs every 40 minutes.
Changes in your IdP (like adding or removing users) will appear in Sally after the next sync.

5.6 Can I disable SCIM once it's active?​

Yes. You can disconnect SCIM at any time in the Sally SCIM Integration settings.
However, already provisioned users will remain in Sally until you remove them manually.