← All keys & policies
Policy·enterprise
Enterprise Managed Users provisioning (SCIM)
Tier 0 · CriticalControl
Why Tier 0
Creates and removes the identities themselves, with their team memberships. That is who exists in the enterprise.
Controls creation, deprovisioning and attribute mapping of Enterprise Managed User identities through SCIM.
Available on: EMU, Server (SCIM provisioning for an instance that uses SAML; managed users are Enterprise Cloud only). Source
Attack path
An attacker with this access can provision a new managed identity with chosen attributes and team memberships, minting a trusted user from nothing inside the enterprise's identity system.
Mitigations
- Protect the SCIM token like an owner credential
- Review provisioning events in the audit log
Detect
Alert on external_identity.provision, external_identity.deprovision, business.disable_open_scim, external_group.add_member in the audit log.
Related permissions
GitHub Docs: Configuring SCIM provisioning for Enterprise Managed Users