> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Directory Sync (SCIM)

> Sync users and groups from your identity provider, link groups to teams, and enforce sign-in against the directory.

ResolveAI supports SCIM 2.0 provisioning. Your identity provider pushes users and groups to ResolveAI. Link a group to a team to keep that team's roster current. You can also enforce sign-in against the directory.

## Set it up

| Provider           | Guide                                               |
| ------------------ | --------------------------------------------------- |
| Okta               | [Okta SCIM Provisioning](/okta-scim)                |
| Microsoft Entra ID | [Microsoft Entra ID SCIM Provisioning](/entra-scim) |

After you configure your provider:

* [Link a group to a team](/scim-team-groups) to have a directory group drive a team roster.
* [Enforce sign-in against the directory](/scim-sign-in-enforcement) once you are satisfied the directory is right.

## What a push changes

**A push does not grant or remove access.** Pushed users appear as active in your imported directory. [Sign-in enforcement](/scim-sign-in-enforcement) controls whether they can sign in, and it is off until you turn it on.

**A pushed group does not affect a team until you link it.** ResolveAI stores every group you assign, but most groups never feed a team. You create the link in ResolveAI; your provider does not create it. See [Linking groups to teams](/scim-team-groups).

**Push users before groups.** If a group names people ResolveAI does not have yet, ResolveAI stores the group push but refuses to reconcile the linked team. The team stays unchanged; it is not emptied. The sync is flagged as needing attention.

## Deactivating and removing

| Provider action   | Result in ResolveAI                                            |
| ----------------- | -------------------------------------------------------------- |
| User set inactive | Account frozen, sessions ended immediately. Not deleted.       |
| User deleted      | Account tombstoned, sessions ended. Record retained.           |
| User re-created   | Account restored. Only a fresh create restores a removed user. |
| Group deleted     | Stops conferring membership; linked teams update.              |

## Supported operations

`/Users` and `/Groups` support list, create, read, replace, update and delete. `/ServiceProviderConfig` and `/Schemas` are readable. Bulk operations, sorting and password changes are not supported. List results default to 100 per page and have a maximum page size of 200.

ResolveAI supports fewer filter forms than the SCIM specification. It accepts the forms that providers send:

* `/Users`: `userName eq "value"` only. `externalId eq` is **not** supported here.
* `/Groups`: `displayName eq "value"` or `externalId eq "value"`.

Any other filter returns an explicit error. ResolveAI does not return an incorrect result set.

## When a push is refused

**"Email domain is not configured for this SCIM connection."** ResolveAI accepts only the email domains configured on your connection. Matching is exact and does not include subdomains. A connection configured for `example.com` refuses `someone@eng.example.com`. This prevents an identity provider from provisioning into a domain it does not own.

Map your provider to send an address on a configured domain, or ask your Resolve contact to add the domain.

ResolveAI reports refusals as **Sync needs attention** on the Authentication page and includes the reason.