Make joiner, mover, and leaver changes automatic.

Provisioning belongs to an existing sign-in connection.

An organization owner first creates and verifies an OIDC or SAML workforce connection in Identity & permissions. Each connection receives a different tenant-specific SCIM base URL and bearer. That binding prevents one customer's directory from writing to another customer's workspace.

Issue the directory credential in four deliberate steps.

1. Open the correct workforce connection

   Sign in as an organization owner, open Identity & permissions, and find the OIDC or SAML connection your directory already uses for sign-in.

2. Select Set up SCIM

   Choose immutable directory object ID matching when your IdP supplies a stable external identifier. Use user name/email matching only when the source cannot supply that identifier.

3. Copy both one-time values

   Paste the tenant-specific base URL and secret token into the directory before closing the dialog. AI Gateway HQ stores only a one-way digest and cannot display the token again.

4. Test, assign, and provision

   Test the connection in your identity provider, assign a pilot group, provision on demand where available, then inspect the provider's provisioning logs.

Use the base URL as the Tenant URL.

1. In the Entra admin center, open the enterprise application used for AI Gateway HQ and choose Provisioning.
2. Create a configuration. Paste the AI Gateway HQ base URL into Tenant URL and the one-time bearer into Secret Token.
3. Select Test Connection. An unknown-user lookup should receive HTTP 200 with an empty SCIM list—not an error.
4. Review user and group attribute mappings. Preserve a stable source object identifier as externalId when using the recommended immutable-ID match mode.
5. Scope the first rollout to assigned users and groups, assign a pilot, use Provision on demand, then start provisioning and monitor Provisioning logs.

Microsoft documents the current enterprise-app workflow, assignment requirement, connection test, and provisioning logs in its Entra SCIM provisioning guide.

Use HTTP Header authentication with the one-time bearer.

1. Open the applicable private app integration. Enable SCIM provisioning for an integration type supported by your Okta tenant and plan.
2. Under Provisioning integration settings, paste the AI Gateway HQ value into SCIM connector base URL.
3. Choose HTTP Header authentication and paste the one-time bearer into the authorization/token field.
4. Enable Push New Users, Push Profile Updates, and Push Groups as required. Assign a pilot and confirm create, update, deactivate, and group membership behavior.

Okta's exact menus vary by engine, entitlement, and integration type. Confirm the current prerequisites in Okta's SCIM app-integration guide.

Pausing writes does not quietly restore a deactivated login.

Enabling enforcement requires at least one eligible active user. Deactivation, deletion, or a change to a user's login match advances the federation session cutoff before the directory mutation commits, so an already-issued gateway session cannot outlive the privilege-reducing change.

Rotate before expiry; revoke during doubt.

Standards discovery, users, groups, filters, and ETags.

The tenant base URL supports SCIM 2.0 discovery, minimal User and Group resources, paged lists, equality filters, POST, PUT, PATCH, DELETE, weak ETags, and If-Match. Request bodies, patch operation counts, page sizes, and group membership are bounded to prevent an identity client from becoming an unbounded memory or storage workload.

GET /ServiceProviderConfig
GET /ResourceTypes
GET /Schemas

Bulk operations, password changes, sorting, arbitrary extension schemas, and SCIM-granted gateway roles are deliberately not advertised. Clients should inspect ServiceProviderConfig and the published schemas rather than assume optional behavior.

Use the failure boundary as the clue.