Automatically deactivate users with SCIM | Flamekeeper Knowledge Base

SCIM deprovisioning connects your identity provider's application assignments to Flamekeeper access. When an assigned user is removed, disabled, deleted, or moved out of the provisioning scope in Okta or Microsoft Entra ID, Flamekeeper deactivates the matching member.

This is an optional addition to Okta or Microsoft SSO. SSO authenticates members; SCIM tells Flamekeeper when an assigned member should lose access.

What Flamekeeper's SCIM connection does

Flamekeeper matches an identity-provider user to an existing Flamekeeper member by email address. The email sent as the SCIM userName must exactly match the member's Flamekeeper email.

When the provider deprovisions that user, Flamekeeper:

changes the member's status to Deactivated;
revokes active Flamekeeper sessions and trusted devices;
removes the member's direct permissions; and
preserves their historical handover contributions under a deactivated name.

The connection does not create Flamekeeper accounts, accept invitations, change roles or profiles, synchronize groups, or reactivate a deactivated member. Invite and manage members through People and invitations. Reassigning a deactivated user in the identity provider does not restore access.

Before you begin

You need:

a Flamekeeper Admin account;
an existing Okta or Microsoft Entra ID SSO configuration;
permission to configure provisioning for the corresponding identity-provider application; and
the intended users already invited to the same Flamekeeper organization with matching email addresses.

Start with one non-admin test member that can safely be deactivated. Deactivation is a real access-control action, not a reversible connection test.

1. Enable SCIM in Flamekeeper

Open Organization settings and select Okta SSO or Microsoft SSO, matching your configured provider.
Select Edit configuration.
Select Automatically deactivate removed users with SCIM.
Select Save configuration.
Copy the displayed SCIM endpoint and SCIM token.

The token is displayed only once. Store it in your approved secret-management system and do not put it in a handover document, ticket, chat message, or screenshot. Flamekeeper stores only a hash of the token.

If the token is lost or exposed, edit the SSO configuration, clear the SCIM checkbox, and save. Then enable it again and save to issue a replacement. Disabling SCIM immediately invalidates the previous token and stops automatic deprovisioning.

2. Connect Okta

Use these steps when the configured provider is Okta:

Open the Flamekeeper application in the Okta Admin Console.
On General, edit App Settings, set Provisioning to SCIM, and save. If SCIM is not available for the OIDC integration, ask your Okta administrator or Okta support to enable a compatible provisioning integration.
Open Provisioning → Integration, select Edit, and enable the API integration.
For SCIM connector base URL, paste the SCIM endpoint from Flamekeeper.
Select SCIM 2.0 and use userName as the unique user identifier where Okta asks for one.
For authentication, choose HTTP Header. In the Authorization field, enter Bearer followed by the one-time Flamekeeper SCIM token.
Enable user creation and update actions so Okta can discover and associate existing Flamekeeper members. Enable user deactivation. Do not enable group push; Flamekeeper does not synchronize SCIM groups.
Select Test API Credentials, then save.
Under To App, confirm that Deactivate Users is enabled. Assign only people who already exist in Flamekeeper with the same email.

Okta may describe the first association as creating or pushing a user. Flamekeeper uses that request only to find the existing member and return its SCIM identifier; it does not create a new account. See Okta's SCIM provisioning setup for the current console workflow.

3. Connect Microsoft Entra ID

Use these steps when the configured provider is Microsoft Entra ID:

In the Microsoft Entra admin center, open Entra ID → Enterprise apps and select the enterprise application used for Flamekeeper SSO.
Open Provisioning and create or edit an automatic provisioning configuration. Portal wording can appear as Get started, Connect your application, or New configuration.
For Tenant URL, paste the SCIM endpoint from Flamekeeper.
For Secret Token, paste the one-time Flamekeeper SCIM token without adding Bearer.
Select Test Connection, then save or create the configuration.
In the user attribute mappings, map the source email or user principal name used by your organization to the target userName. Its value must match each member's Flamekeeper email.
Keep user create, update, and delete actions enabled. Disable group-object provisioning because Flamekeeper does not synchronize SCIM groups.
Set the provisioning scope to the assigned users you intend to manage, assign a small pilot group, and start provisioning.

Microsoft's provisioning service runs an initial cycle and then incremental cycles, so a directory change may not appear immediately. Use Provision on demand for a controlled test when that option is available. Review Microsoft's automatic provisioning overview and deployment guidance for current portal and rollout details.

4. Test deprovisioning

Use a non-admin pilot member whose Flamekeeper email matches the provider's userName value.

Assign or provision the member and confirm that the provider reports success.
Confirm that the existing member remains active in People. No duplicate member should appear.
Remove the user from the application assignment or provisioning scope, or disable the user in the provider according to your offboarding policy.
Trigger an on-demand provisioning run or wait for the provider's next cycle.
In Flamekeeper People, confirm that the member shows Deactivated.
Confirm that the member can no longer open Flamekeeper, including from a session that was active before the change.

Do not use your only Flamekeeper administrator for this test. Reassigning the user in Okta or Entra does not reactivate their Flamekeeper account.

Troubleshooting

What you see	What to check
Test connection returns unauthorized	Confirm SCIM is still enabled, the endpoint belongs to this organization, and the current token is used. In Okta, the Authorization value must start with `Bearer` . In Entra, paste only the token into Secret Token.
The provider cannot find or associate a user	Confirm the person already exists in Flamekeeper and `userName` exactly matches their lowercase Flamekeeper email.
Provisioning reports that account creation failed	Invite the member to Flamekeeper first. SCIM deliberately cannot create accounts or grant roles.
A removed user is still active	Check the provider's provisioning status and logs, assignment scope, latest cycle, and whether deactivation or delete actions are enabled.
Group provisioning fails	Disable group push or group-object synchronization. Flamekeeper supports user deprovisioning only.
A reassigned user remains deactivated	This is expected. SCIM cannot reactivate accounts; use your organization's approved account-recovery process or contact Flamekeeper support.
The token is no longer visible	Tokens are shown once. Disable and re-enable SCIM in Flamekeeper, then update the provider with the replacement token.

Disable or rotate the connection

To stop SCIM deprovisioning, edit the SSO configuration, clear Automatically deactivate removed users with SCIM, and save. The endpoint then rejects the old token. Stopping the job only in Okta or Entra leaves the Flamekeeper token valid, so disable SCIM in Flamekeeper when retiring the connection.

To rotate credentials, disable SCIM in Flamekeeper and save, then enable it again. Copy the new token into the provider, test the connection, and restart provisioning. Changing the SCIM setting does not disable OIDC sign-in; use the separate Disable SSO control when you also intend to stop company sign-in.