Skip to main content
This topic explains how to enable SCIM user provisioning to work with your SSO-enabled LaunchDarkly account. SCIM facilitates user provisioning, which means your IdP can use it to create, update, and deactivate members in LaunchDarkly.

​
Prerequisites

User provisioning with SCIM is available to customers on select plansSCIM is only available to customers on an Enterprise plan. To learn more, read about our pricing. To upgrade your plan, contact Sales.
You cannot manage teams using the UI after enabling SCIMIf you configure SCIM to provision resources from identity providers, you can no longer manage teams using the LaunchDarkly user interface.
To complete this procedure, you must have the following prerequisites:
  • You must have a LaunchDarkly Admin organization role, or an Admin or Owner base role.
  • You must have enabled SSO. To do this, read Configure SAML SSO.
You may have only one IdP linked to your LaunchDarkly account at once. If you need to change providers, disconnect the original provider by following the workflow below and enable a different one through your IdP. You cannot deactivate an account member using SCIM deprovisioning if you added the member to your LaunchDarkly account before you enabled SCIM provisioning or SSO.

​
Configure SCIM

LaunchDarkly has a SCIM API available to allow for user provisioning of account members from IdPs. The SCIM API is only supported for the OAuth2 authorization type. Not all supported third-party providers support user provisioning through SCIM. To learn more about how LaunchDarkly treats users imported from the IdP, read Default initial role. We have pre-built integrations with the following providers: You may also manually configure other providers, such as Entra ID (formerly Azure Active Directory). To do this, you need to provide certain information required for authentication. To learn more, read Authentication in the SCIM API reference.

​
Migrating identity providers

When you migrate from one IdP to another, LaunchDarkly members retain the same permanent member ID. This member ID is visible in the member’s profile URL, for example /settings/members/{member_id}/permissions. This means you can migrate from one IdP to another without updating any personal API access tokens, service tokens, or SDK credentials.

​
Disconnect SCIM

You can disconnect SCIM at any time. To disconnect SCIM:
  1. Log in to LaunchDarkly with a LaunchDarkly Admin organization role, or an Admin or Owner base role.
  2. Click the gear icon in the left sidebar to view Organization settings.
  3. Click Security and scroll to the “SSO management” section.
  4. Click Disconnect SCIM.

​
Team sync with SCIM

Team sync with SCIM is available to customers on select plansTeam sync with SCIM is only available to customers on an Enterprise plan. To learn more, read about our pricing. To upgrade your plan, contact Sales.
Team sync is available for OktaTeam sync is only available for Okta. Team sync is not available for other IdPs.
LaunchDarkly allows you to sync groups from Okta to teams within your account. You can use this feature to create a new team or link an existing team with the same name to an Okta group. After you turn on team sync:
  • You can only create new teams through Group Push in Okta, and not from the LaunchDarkly UI.
  • You can only make changes to your synced teams’ names and memberships through Okta. You can still maintain unsynced teams in the LaunchDarkly UI.
  • You will still manage team permissions from within LaunchDarkly. To learn how to add roles to a team, read Assigning roles to teams. Team maintainers and team description will also be managed from the LaunchDarkly UI.
  • A member’s individual roles will aggregate with the custom roles that you apply to their teams.
  • LaunchDarkly will not delete any existing teams.
To use team sync, you must have administrator access in LaunchDarkly and you must have configured SCIM for your LaunchDarkly account. To turn on team sync in LaunchDarkly:
  1. Log in to LaunchDarkly with a LaunchDarkly Admin organization role, or an Admin or Owner base role.
  2. Click the gear icon in the left sidebar to view Organization settings.
  3. Click Security and scroll to the “SSO management” section.
  4. Click Turn on team sync. A confirmation dialog appears.
  5. Click Turn on team sync.
    The "Turn on team sync" option within the "SSO management" section of the "Security" tab.

    The "Turn on team sync" option within the "SSO management" section of the "Security" tab.

You can now manage teams within the admin panel of Okta. Teams you have synced with Okta have limited team management permissions in LaunchDarkly. To learn more about managing teams in Okta, read Use Okta to manage LaunchDarkly teams with SCIM. We recommend using either SCIM-based or SAML-based member role and team assignment. If you use both SAML and SCIM methods at the same time, team assignment set up with the SAML custom attribute (teamKey) will be overridden by SCIM team assignment.

​
Disable team sync with SCIM

You can disable team sync with SCIM from the “SSO management” section on the Security page. If you disable team sync with SCIM, LaunchDarkly does not remove any teams that you originally created using Okta. You can continue to manually edit those teams as needed.