Single sign-on (SSO)

Set up SCIM provisioning for the Ploy dashboard

Provision dashboard users and groups from your identity provider with SCIM. Your identity provider, such as Microsoft Entra ID or Okta, calls Ploy's SCIM 2.0 service to create, update, and remove dashboard users and groups. You set everything up from the SCIM provisioning page in Ploy's organization settings.

Before you start

You need owner access in the Ploy dashboard. Only owners can set up or change the SCIM configuration.

Set up SCIM in Ploy

  1. In the Ploy dashboard, open your organization settings and go to the SCIM provisioning page.

  2. Click Set up SCIM. This creates your SCIM configuration with provisioning enabled, and dashboard roles stay managed in Ploy until you change that.

  3. Copy the SCIM base URL (Tenant URL) shown on the page. Your identity provider uses it as the SCIM server URL.

  4. Copy the token shown under Secret token. It is shown only once.

Paste the token into your identity provider now. If you lose it before that, click Generate new token to get a fresh one.

Connect your identity provider

In your identity provider, create a SCIM integration for Ploy and paste in the two values from the previous step: the SCIM base URL as the tenant URL, and the token as the bearer token. The SCIM provisioning page names Microsoft Entra and Okta as examples.

Once connected, your identity provider pushes users and groups to Ploy over the SCIM 2.0 protocol.

What your identity provider can push

Ploy implements SCIM 2.0 for Users and Groups, and answers the standard discovery endpoints (/ServiceProviderConfig and /ResourceTypes).

  • Users: create, list, read, update through PUT or PATCH, and delete. Ploy reads the userName, name, emails, externalId, and active fields. The userName is the person's Ploy login email, and SCIM cannot change it.

  • Groups: create, list, read, update through PUT or PATCH, and delete, including membership changes. Ploy reads the displayName, externalId, and members fields.

How removal works

When your identity provider deletes a user through SCIM, Ploy removes that person's membership in your organization. Their Ploy account itself stays, because it may be used by other organizations. Setting active to false disables the membership instead of removing it.

Owners are protected: SCIM cannot remove or deactivate a dashboard owner.

Map pushed groups to dashboard roles

Pushed groups have no role by default. On the SCIM provisioning page you can map each pushed group to Member or Admin, and clear the mapping again.

By default, dashboard roles are managed in Ploy. To have roles follow your identity provider's groups instead, switch the role source to your identity provider. Ploy immediately re-derives the roles of SCIM-managed users from their groups, and group role changes then take effect immediately for group members.

Rotate the SCIM token

Rotate the token when it may have been exposed, or when your security policy requires it.

  1. On the SCIM provisioning page, click Generate new token.

  2. Confirm with Generate. The new token replaces the old one immediately.

Turn SCIM off or remove it

Turning provisioning off pauses SCIM but keeps your configuration. While it is off, Ploy rejects SCIM requests made with your token.

Removing the SCIM configuration is permanent. It removes the pushed groups, hands SCIM-managed memberships back to Ploy, clears the users' SCIM external IDs, and deletes the configuration, so the token stops working.

To also let people sign in to the dashboard through your identity provider, see Set up SAML single sign-on.

Was this helpful?
Was this helpful?