Automatic provisioning (SCIM)

With SCIM, your identity provider — Okta, Microsoft Entra ID, OneLogin, JumpCloud and others — adds people to your Teti organization and removes them on its own. When someone joins the team they get access; when they leave the company and you deactivate them in your provider, they leave the organization right away.

SCIM is included in every Teti Business plan. Only the owner of the organization can set it up, in Settings → Organization. It works best together with single sign-on.

Before you start

• Verify your domains in Settings → Organization → Domains (see SSO and MFA). Teti accepts only people with an email on your verified domains.
• Make sure you have enough seats (see Teti Business).

1. Generate the token

1. Go to Settings → Organization → SCIM.
2. Copy the SCIM base URL.
3. Click Generate token and copy it right away: Teti shows it only once.

If you lose the token, click New token: the old one stops working immediately and you paste the new one into your provider. Revoke stops provisioning altogether.

2. Connect your provider

Okta

1. Open the Teti app you created for SSO (or create a SAML app), and in General → App Settings turn on SCIM provisioning.
2. In Provisioning → Integration: SCIM connector base URL = Teti's SCIM base URL, Unique identifier field for users = userName, Supported provisioning actions: Push New Users and Push Profile Updates, Authentication Mode: HTTP Header, and paste the token as the Bearer token. Click Test Connector Configuration, then Save.
3. In Provisioning → To App, enable Create Users, Update User Attributes and Deactivate Users.
4. Assign people or groups in Assignments: Okta adds them to Teti.

Microsoft Entra ID

1. Open the Teti enterprise application, go to Provisioning and choose the Automatic mode.
2. Tenant URL = Teti's SCIM base URL, Secret Token = the token. Click Test Connection, then Save.
3. In Mappings, turn off Provision Microsoft Entra ID Groups (Teti manages people, not groups). In Provision Microsoft Entra ID Users, make sure userName is mapped to the user's email (mail, or userPrincipalName if it's the same as the email).
4. Set Provisioning Status to On. Entra syncs about every 40 minutes; you can provision someone right away with Provision on demand.

Google Workspace

Google Workspace offers automatic provisioning only for apps in its catalog, not for custom SAML apps. With Google Workspace, add people by invitation in Settings → Members.

What happens in Teti

In your provider	In Teti
Someone is assigned to the app	They join the organization as a member, with a free Standard seat. If no Standard seat is free, they join without one and the owner assigns it in Settings → Members. Premium seats are only assigned by the owner.
They don't have a Teti account yet	Teti creates one for their work email; the organization is already open when they first sign in (with SSO or an email link).
They are deactivated or unassigned	They leave the organization and lose access to it. Their chats in the organization stay with the organization, and their seat is freed.
They are reactivated	They join again.
Their email changes	Teti treats the new email as a new person: the old address leaves, the new one joins.

The owner of the organization is never removed by SCIM. Groups aren't synced: assign groups in your provider and it provisions their members one by one.

People provisioned by SCIM also appear in Settings → Members, where you can change their seat.

When Business ends

The token stops working with Business and your provider reports an error; people already in the organization stay until you remove them. If you reactivate Business, provisioning resumes with the same token.

Technical details

Teti implements SCIM 2.0 (RFC 7643 and 7644) for users: GET, POST, PUT, PATCH and DELETE on /Users, filters on userName and externalId, plus /ServiceProviderConfig, /ResourceTypes and /Schemas. Authentication is a Bearer token, stored by Teti only as a hash.