Private beta, Enterprise plan only. SCIM user provisioning is currently in private beta and is not enabled for all customers yet. It is available exclusively on the Enterprise tier. If you would like to use SCIM, contact us and we will enable it for your organization.
SCIM (System for Cross-domain Identity Management) lets your identity provider (IdP), such as Okta, manage Pensero users for you. When someone joins, changes role or leaves your company, the change is pushed to Pensero automatically, so you no longer have to add or deactivate people by hand.
What SCIM does in Pensero
Creates users when they are assigned to the Pensero app in your IdP.
Updates users when their profile changes (name, manager, Git usernames, level, start date and more). An existing user’s email is never changed by SCIM; if their
userNamechanges, it is stored as their username.Deactivates users when they are unassigned, deactivated or deleted in your IdP.
SCIM does not:
Sync groups or teams. Pensero does not expose a Groups endpoint. Teams are still managed in Pensero.
Require SSO. SCIM works independently of your login method. (Okta does require a SAML app to expose the Provisioning tab, but you do not have to enable SAML login.)
Permanently delete data. Deleting a user in your IdP deactivates them in Pensero and keeps their historical data.
Who can use it
SCIM provisioning is included in the Enterprise plan (see Pensero plans and pricing explained) and can be configured by organization administrators. If you are on Enterprise and do not see the User provisioning page in your Organization Settings, contact us and we will enable it for your organization.
Enable SCIM in Pensero
Go to Organization Settings → User provisioning.
Click Generate token.
Copy the full token string (in the form
token:secret). It is shown only once. If you lose it, click Regenerate token to create a new one.Use the connection details on this page to configure your IdP:
SCIM base URL:
https://pensero.ai/api/scim/v2Unique identifier field:
userNameAuthentication mode: HTTP Header (Bearer token)
For a step-by-step Okta guide, see Set up SCIM with Okta. For another identity provider or a direct SCIM client, see Set up SCIM with a different identity provider.
Managing the token
Regenerate token creates a new token and immediately invalidates the previous one. Update your IdP right away or provisioning will stop with 401 errors. A 401 is also returned when user provisioning is not enabled for your organization.
Revoke token disables SCIM until a new token is generated. Existing users are not affected.
How the user lifecycle works
New users
When a user is pushed for the first time, Pensero looks for an existing user with the same email (userName). If one exists, it is updated and linked to the IdP record instead of creating a duplicate. Otherwise a new user is created.
New users are measured by default and use an active seat. If provisioning a user would exceed your seat limit, the request fails with a seat-limit error in your IdP. Add seats or free existing ones and retry the push. See How to add and manage seats.
Login access
Provisioning a user does not automatically let them sign in to Pensero. Login is opt-in through the penseroLoginEnabled attribute (off by default). Your IdP owns this setting: every full profile push (create or update) that does not include penseroLoginEnabled sets login back to off, so enabling login by hand in Pensero is undone on the next sync unless the attribute is mapped in your IdP. See How the Viewer role works for the difference between being measured and having login access.
Updates
Profile changes in your IdP are applied on the next push. Manager assignments are resolved by the manager’s email, so the manager must already exist in Pensero. If the email does not match any user in your organization, the push for that user fails with a 400 error naming the address; provision the manager first, then retry.
Deactivation
When a user is unassigned from the app, set to inactive, or deleted in your IdP, Pensero:
Deactivates the user and disables login.
Ends their reporting lines and team memberships.
Frees their active seat.
Keeps their historical activity and metrics.
Reactivating the user in your IdP reactivates them in Pensero and they use a seat again. Reactivation restores the active status only: login stays off unless penseroLoginEnabled is sent, and the manager and team memberships that were ended on deactivation are not restored until the manager is pushed again.
Frequently asked questions
Can SCIM create teams from my IdP groups?
Not yet. Pensero accepts a team attribute but does not apply it, and there is no Groups endpoint. Manage teams in Pensero.
What happens to users I created manually before enabling SCIM?
They are matched by email the first time the IdP pushes them, so nothing is duplicated.
Do I need SSO to use SCIM?
No. SCIM and SSO are independent.
What if a user’s email is already used in another Pensero organization?
The push fails with a uniqueness (409) error. Emails and Git handles must be unique across Pensero.