Skip to main content
ResolveAI supports SCIM 2.0 provisioning. Your identity provider pushes users and groups to ResolveAI. Link a group to a team to keep that team’s roster current. You can also enforce sign-in against the directory.

​
Set it up

After you configure your provider:

​
What a push changes

A push does not grant or remove access. Pushed users appear as active in your imported directory. Sign-in enforcement controls whether they can sign in, and it is off until you turn it on. A pushed group does not affect a team until you link it. ResolveAI stores every group you assign. See Team Membership. Push users before groups. People who do not have a ResolveAI account yet are left off the linked team. See Team Membership troubleshooting.

​
Deactivating and removing

​
Supported operations

/Users and /Groups support list, create, read, replace, update and delete. /ServiceProviderConfig and /Schemas are readable. Bulk operations, sorting and password changes are not supported. List results default to 100 per page and have a maximum page size of 200. ResolveAI supports fewer filter forms than the SCIM specification. It accepts the forms that providers send:
  • /Users: userName eq "value" only. externalId eq is not supported here.
  • /Groups: displayName eq "value" or externalId eq "value".
Any other filter returns an explicit error. ResolveAI does not return an incorrect result set.

​
When a push is refused

“Email domain is not configured for this SCIM connection.” ResolveAI accepts only the email domains configured on your connection. Matching is exact and does not include subdomains. A connection configured for example.com refuses someone@eng.example.com. This prevents an identity provider from provisioning into a domain it does not own. Map your provider to send an address on a configured domain, or ask your Resolve contact to add the domain. ResolveAI reports refusals as Sync needs attention on the Authentication page and includes the reason.