IntegrationIntermediatescimprovisioningidentity
Implement SCIM provisioning for user lifecycle
Real World Scenario
HR system deprovisions employees but Salesforce licenses remain active 30 days creating security gap.
Expected Answer
• SCIM API automate user create update deactivate from IdP
• Immediate deactivation on HR termination event
• License reclamation workflow freeing seats
• Role mapping IdP groups to Salesforce permission sets
• Rehire scenario reactivation not duplicate user
• Audit log provisioning actions
• Break-glass local admin excluded from SCIM
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. SCIM API automate user create update deactivate from IdP. Immediate deactivation on HR termination event. Pick based on your integration pattern and team capability. User deprovisioning SLA should match HR termination same-day—SCIM closes orphan account gap. Balance speed of delivery with maintainability.
Architect Perspective
User deprovisioning SLA should match HR termination same-day—SCIM closes orphan account gap.