SCIM lets your identity provider (IdP) manage your HelpDocs members for you. When you add someone to the HelpDocs app in your IdP, they become a member of your HelpDocs account. When you remove them, they lose access. Groups you push from your IdP become HelpDocs groups, and you can give each group a role.
SCIM works with Okta, Microsoft Entra ID, and any other IdP that supports SCIM 2.0.
You'll find a SCIM provisioning section in Settings > Sign-in & access, just below Single sign-on. You need permission to edit settings to use it.
If your account's users are managed by a parent account, the section doesn't show. Set up SCIM on the parent account instead.
What SCIM does
Your IdP can:
Add new members. HelpDocs doesn't send them an invitation email. They sign in with SSO.
Link people who are already members. HelpDocs matches them by email address.
Update a member's name, and their email address if SCIM created their HelpDocs login.
Deactivate and reactivate members.
Remove members.
Create, rename, and delete groups, and add or remove their members.
Take over existing HelpDocs groups you've linked, so their article permissions keep working. See Link existing groups.
Every change your IdP makes shows in your Audit log as SCIM: <token name>, using the name of the token your IdP connects with.
Members your IdP manages show a Managed badge in Settings > People. Once you've created a SCIM token, HelpDocs refuses to change a managed member's role or remove them. It also refuses to rename or delete a group your IdP pushed, or change who's in it. You'll see "Managed by your identity provider". Make those changes in your IdP. You can still add managed members to groups you made in HelpDocs, and remove them. See Members are managed by your IdP.
Roles
New members get your Default role, which you set under New people in Settings > Sign-in & access. To give people a different role, pick a role for each IdP group. Each person gets the highest role from their groups. See Give SCIM groups a role.
How SCIM changes SSO sign-in
SCIM takes over from SSO once you've created at least one SCIM token. From then on, for SAML and OpenID Connect sign-in (including Google and Microsoft sign-in):
Members sign in as normal. Their role and groups don't change when they sign in, whatever your IdP sends at sign-in. SCIM decides those.
SSO sign-in no longer creates new members.
SSO sign-in doesn't accept pending invitations. If you invite someone in HelpDocs, they need to accept the invitation from their email before they sign in with SSO. Until then, they're treated like someone your IdP hasn't provisioned.
Someone your IdP hasn't provisioned can still read your help center as an anonymous reader, if you allow that. Anonymous readers are allowed when Create accounts for readers is turned off in your Single sign-on settings. Your Email domains still apply.
If you don't allow anonymous readers, someone your IdP hasn't provisioned can't sign in. They see a message asking them to contact their HelpDocs administrator.
Sign in with Slack follows the same rules, if you have it turned on. Members sign in as normal. Slack sign-in has no anonymous readers, so anyone your IdP hasn't added is refused, including deactivated members. Slack sign-in never creates or adds members.
What happens when someone is deactivated
When your IdP deactivates someone:
They lose access to your HelpDocs account straight away, and their API keys stop working on it.
Their seat is freed.
HelpDocs remembers their role and groups.
Their HelpDocs login and any other HelpDocs accounts they belong to aren't affected.
To see deactivated people, open Settings > People and filter by the Deactivated status.
When your IdP reactivates them, they get their role back and rejoin the groups they were in, as long as those groups still exist. Reactivating needs a free seat.
What happens when someone is deleted
When your IdP deletes someone, they're removed from your HelpDocs account. If they don't belong to any other HelpDocs account, their HelpDocs login is deleted too.
Things SCIM won't do
Change the account owner's role, or deactivate or remove the owner. Transfer ownership in HelpDocs first if you need to.
Change the account owner's email address.
Change the email address of someone whose HelpDocs login SCIM didn't create, such as a member it linked by email. Change it in HelpDocs instead.
Add someone, or change someone's email address, when the address doesn't match your Email domains.
Manage HelpDocs staff.
Change the email address of someone who also belongs to HelpDocs accounts outside your organization. Their name won't change either.
Add someone whose existing HelpDocs login is also used in accounts outside your organization.
Seat limits
SCIM can't add or reactivate members once your account has reached its user limit. Your IdP gets this error:
"This HelpDocs account has reached its user limit. Remove a member or upgrade the plan, then retry."
Pending invitations count toward the limit. When SCIM fills your last seat, HelpDocs sends the same user limit notice it sends when SSO sign-in fills it.
What SCIM doesn't manage
SCIM manages HelpDocs members: the people who sign in to write and manage your docs. It doesn't manage help center readers, such as anonymous SSO readers or readers who sign in with JWT.
Supported identity providers
Any other identity provider that supports SCIM 2.0, such as JumpCloud, OneLogin, Ping Identity, or Rippling
Google Workspace isn't supported yet.