SCIM (System for Cross-domain Identity Management) 2.0 is an open standard that enables Identity Providers (IdPs) to automatically provision and manage users and groups across applications.
By connecting your IdP to Genea using SCIM 2.0, you can automatically create, update, and deactivate users, as well as synchronize user groups and their memberships. This eliminates the need to manage these changes manually in Genea.
This article explains how to configure SCIM 2.0 provisioning for identity providers that do not have a dedicated integration in Genea.
Prerequisites: You must have administrative access to both your IdP and Genea.
Using Okta, Microsoft Entra ID, or OneLogin? Use the dedicated integration for that provider instead. See Related Articles at the end of this page.
TL;DR
Sync users and groups from any SCIM 2.0 identity provider to Genea automatically.
Set it up under Integrations → SCIM, then paste the Genea token into your IdP.
IdP must support SCIM 2.0 outbound provisioning and bearer token authentication.
Available only on portals with User Groups enabled.
What Does the Integration Support?
The SCIM 2.0 integration supports the following provisioning capabilities:
User Creation: Automatically creates users in Genea when they are assigned to the Genea application in your IdP.
Existing User Linking: Identifies existing Genea users using their email address or external ID and links and activates them instead of creating duplicate accounts.
Profile Updates: Automatically synchronizes changes to user profile information, including names, email addresses, phone numbers, and other supported attributes.
User Deactivation: Deletes users from Genea when they are deactivated or unassigned from the Genea application in your IdP, removing their access.
Group Synchronization: Creates corresponding User Groups in Genea for groups assigned to the Genea application in your IdP.
Group Membership Synchronization: Automatically updates Genea User Group memberships when users are added to or removed from synchronized groups in your IdP.
Custom Attribute Synchronization: Synchronizes supported custom attribute values sent by your IdP and updates the corresponding user profiles in Genea.
Audit Trail: Records all changes made through the SCIM integration in Genea Audit Logs, with SCIM identified as the actor.
Important Notes
Before enabling provisioning, review the following integration behaviors:
User matching: Genea matches incoming users using their email address or external ID. If a matching user already exists, Genea links and activates the existing account instead of creating a duplicate.
UserName attribute: The SCIM
userNameattribute must contain the user's email address.Source of truth: Your IdP is the source of truth for synchronized users and groups. Manage their information and group memberships in your IdP.
Group provisioning: Assigning a group to the Genea application creates a corresponding User Group in Genea. However, this does not automatically provision its members. Users must also be assigned to the Genea application.
User deactivation: Deactivating or unassigning a user from the Genea application deletes the user from Genea and removes their access. It does not simply deactivate their access.
One-way synchronization: Synchronization happens from your IdP to Genea. Users and groups created manually in Genea are not synchronized back to your IdP.
Important: Since deactivation or unassignment results in user deletion from Genea, verify your IdP provisioning and assignment rules.
Step 1: Install SCIM in Genea and Copy Your Integration Token
Genea gives you a token that your IdP uses to send changes to your portal.
Log in to the Genea web application and go to Integrations.
Find the SCIM tile and click Install. If SCIM is already installed, click Manage.
Under Your SCIM Integration Token, click Show and copy the token. You'll paste it into your IdP in Step 2.
Keep this token secret. Anyone with the token can create, change, and delete users and groups in your Genea portal. If it is exposed, contact Genea Support right away.
Step 2: Configure Your Identity Provider
Next, configure your IdP to communicate with Genea using the SCIM integration details. If your IdP provides a built-in SCIM 2.0 connector or application template, you can use it. Otherwise, create a new application and enable SCIM provisioning.
The exact configuration labels may vary depending on your IdP. Use the following values:
Configuration | Value |
SCIM Base URL (US) |
|
SCIM Base URL (EU) |
|
Authentication Method | Bearer token (sometimes called "HTTP Header" or "OAuth Bearer Token") |
Token / API Key | SCIM Integration Token copied in Step 1 |
Unique User Identifier |
|
userName Value | User's email address |
Configure the provisioning settings:
Open the SCIM 2.0 connector or the application you created in your IdP's admin console.
Enter the SCIM Base URL corresponding to your Genea region.
Select Bearer Token as the authentication method.
Paste the SCIM Integration Token generated in Step 1.
If your IdP provides a Test Connection option, run the test to verify the connection.
Enable the following provisioning actions:
Create users
Update user attributes
Deactivate users
Provision groups
Save your configuration.
Recommendation: Start by assigning a small test group to the Genea application. Verify that users and groups are synchronized correctly before expanding the assignment to your entire organization.
Step 3: Configure User Attribute Mapping
Attribute mapping determines how information from your IdP is populated in Genea user profiles.
Configure the following SCIM 2.0 attribute mappings in your IdP.
1. Core User Attributes
SCIM Attribute | Genea Field | Requirement |
| Email (Login) | Required |
| First Name | Required |
| Last Name | Required |
| Recommended | |
| Phone | Optional |
| External User ID | Recommended |
| User Status | Required |
Note: The userName attribute must contain the user's email address. It is used as the primary login identifier. If only the first name or last name is updated, Genea retains the existing value of the other name field.
2. Enterprise User Attributes
Genea also supports the following enterprise attributes under the SCIM 2.0 Enterprise User schema:
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
SCIM Attribute | Genea Field |
| Employee Number |
| Department |
| Cost Center |
Configure these attributes in your IdP to synchronize the corresponding employee information to Genea.
3. Custom Attribute Mapping
If your Genea portal uses Custom Attributes, you can also synchronize their values through SCIM.
To configure custom attribute mapping:
In Genea, navigate to Custom Attributes.
Locate the required custom attribute.
Open its Directory Integration configuration.
Navigate to the SCIM tab.
Note the External Name and External Namespace configured for the attribute.
In your IdP, configure the attribute mapping to send the value using the same External Name and External Namespace.
For example, your IdP may need to send custom attribute values under the following namespace:
urn:ietf:params:scim:schemas:extension:enterprise:custom:2.0:User
Use the exact namespace and external name displayed in Genea rather than assuming the example applies to your configuration.
Date Attribute Format
When synchronizing date-type custom attributes, use either of the following supported formats:
ISO 8601:
2026-11-06MM/DD/YYYY:
11/06/2026
Values sent in unsupported date formats will be saved as empty.
Step 4: Synchronize Users and Groups
Once the SCIM connection and attribute mappings are configured, you can assign users and groups to the Genea application in your IdP.
For easier administration, we recommend organizing users into groups in your IdP, such as:
Employees
Contractors
IT Admins
Assign these groups to the Genea application to initiate synchronization.
Keep in mind that assigning a group provisions the corresponding User Group in Genea. Users must also be assigned to the Genea application for their accounts to be created or linked.
Verify synchronization in Genea:
Navigate to User Management > All Users in Genea and refresh the page to view synchronized users.
Navigate to User Groups to view the groups synchronized from your IdP.
Verify that the expected users are assigned to the corresponding User Groups.
Check the user profiles to confirm that the mapped attributes have been populated correctly.
Once synchronized, you can configure the appropriate physical, portal, and mobile access permissions for your User Groups in Genea.
What Happens in Genea When Changes Are Made in Your IdP?
The following table explains how Genea handles different provisioning events received from your IdP.
Action in Your IdP | Result in Genea |
Assign a new user to the Genea application | A new user is created and activated. |
Assign an existing Genea user based on matching email or external ID | The existing user is linked and activated. No duplicate is created. |
Update a user's profile | Only the attributes that have changed are updated. |
Deactivate or unassign a user from the Genea application | The user is deleted from Genea and loses access. |
Reactivate a previously deactivated user | The user is activated again. Restoration of previous group memberships depends on your IdP. |
Assign a group to the Genea application | A corresponding User Group is created in Genea with the same name. |
Add a user to a synchronized group | The user is added to the corresponding Genea User Group. |
Delete a group or unassign it from the Genea application | The corresponding Genea User Group is deleted. |
Audit Logs: All changes made through the SCIM integration are recorded in Genea Audit Logs, with SCIM identified as the actor.
Troubleshooting
If you encounter issues during configuration or synchronization, refer to the following troubleshooting steps.
Issue | Possible Cause and Resolution |
SCIM tile is not visible | User Groups may not be enabled on your Genea portal. Contact your Genea account manager to verify availability. |
Test Connection fails or returns a 401 error | Verify that the complete SCIM token has been copied without additional spaces. Check that the base URL ends with |
User is not synchronized | Confirm that the user is assigned to the Genea application in your IdP and that the |
Group is synchronized but has no users | Group assignment alone does not provision users. Ensure that the group's members are also assigned to the Genea application. |
Custom attribute value is empty | Verify that your IdP is sending the value using the exact External Name and External Namespace configured in Genea. For date attributes, confirm that the value uses a supported format. |
If the issue persists, contact Genea Support with your IdP name, the affected user or group details, and the approximate time of the failed synchronization.
Related Articles
If you are using one of the following identity providers, refer to its dedicated Genea integration guide:
If you have any questions about this integration or need help along the way, please reach out to Genea Support at acsupport@getgenea.com with your IdP name and the time of the failed sync.