SCIM Provisioning and Offboarding with Entra ID and Okta

Imagine Kasia, the one-person IT team at a 180-person company. On Friday afternoon a salesperson leaves. Kasia disables the account in the identity provider, removes the laptop from device management and closes the ticket.

What she does not think about is the desk-booking tool. The leaver's account there stays active. Worse, he had a permanently assigned parking spot, P-14. On Monday it is still marked as his, so nobody books it, and it stays empty for three weeks until someone at reception asks why.

On the same Monday a new hire arrives and cannot book a desk, because nobody created her account. Two small gaps, one at each end of the employee lifecycle, and both come from keeping the user list by hand.

SCIM closes both. Here is how it works in Desk & Park, step by step.

Step 1: generate the token in Desk & Park

In the organisation settings, an admin opens the User provisioning (SCIM) card. It shows two things to copy:

the SCIM endpoint (the Tenant URL your identity provider calls);
a token, created with Generate token.

The token is shown exactly once. Desk & Park keeps only a hash of it, so if you lose it, you rotate it rather than look it up. Rotate token invalidates the old one immediately, and Revoke stops provisioning straight away. The card then tells you whether the token is still waiting for its first sync or when the identity provider last synced.

Step 2: connect Microsoft Entra ID or Okta

Microsoft Entra ID. In the Entra admin center, go to Enterprise applications → New application → Create your own application (a non-gallery app). Under Provisioning, choose Automatic, paste the endpoint as the Tenant URL and the token as the Secret Token, and run Test Connection. In the attribute mappings, userName must be the e-mail address (userPrincipalName or mail); given name and surname map to first and last name; active drives activation and deactivation; department is optional. Assign the people who should have access and turn provisioning on.

Okta. Use the SCIM 2.0 Test App (OAuth Bearer Token) from the catalogue, or your own app with SCIM enabled. Set the SCIM connector base URL to the endpoint, the unique identifier field to userName, and authentication to an HTTP header bearer token. Enable Create Users, Update User Attributes and Deactivate Users, then assign people.

SCIM is available on every plan.

Step 3: what happens when someone joins

When Entra or Okta pushes a new person, Desk & Park creates the account with:

the e-mail as the login, first and last name, the external ID and, if you map it, the department;
the Employee role;
no password. People sign in through single sign-on or with a one-time e-mail code.

So on Monday morning the new hire opens Desk & Park, signs in through the company's identity provider and books a desk. Nobody in IT touched the booking tool.

No plan limits the number of users, so provisioning never runs into a user quota: everyone you assign in the identity provider gets an account, on the free Start plan as well.

Step 4: what happens when someone changes teams or names

A change in the identity provider, such as a new surname or a move to another department, flows through on the next sync. In Desk & Park those fields are then locked for that user: an admin who tries to edit the name or department sees that they are managed by the identity provider and should be changed there. One source of truth, and no quiet drift between two systems.

Step 5: what happens when someone leaves

This is the part Kasia cares about. When the identity provider sends active: false, or deletes the user, Desk & Park deactivates the account. Deactivation does three things at once:

All sessions end immediately. That includes access tokens already issued to the person's browser or phone, not just the ability to sign in again.
Permanent assignments are released. A permanently assigned desk or parking spot goes back to the shared pool, and the audit log lists which spaces were released. Spot P-14 can be booked on Monday.
History stays. Past reservations are kept and still count in reports for the periods they belong to. Nothing is hard-deleted.

If the person comes back and is reactivated in the identity provider, the account becomes active again with its history. Permanent assignments are not restored automatically; an admin assigns them again if needed.

The same clean-up runs when an admin deactivates someone by hand in Desk & Park, so the result does not depend on which path was used.

Built-in safety rails

A provisioning token is a powerful credential, so SCIM is deliberately limited:

It never deactivates the last active admin of the organisation. The request is refused, so a misconfigured assignment in the identity provider cannot lock everyone out.
It never changes the login e-mail of an account with a higher-privilege role. Changing an admin's login address is how a stolen token could take that account over, so those addresses are changed by an admin in Desk & Park only.
Every SCIM change is recorded in the audit log under the actor scim-provisioning, alongside everything else admins do.

Practical tips

Pair SCIM with SSO. SCIM creates the account; single sign-on signs the person in. Desk & Park does not create accounts on a first SSO login, so SCIM is what keeps the user list complete.
Map the department. It feeds the department reports, so the numbers in right-sizing a department stay accurate without manual edits.
Test with one person first. Assign a single test user, check the account appears with the right name and department, deactivate it, and confirm the sessions end and any permanent space is released.
Store the token in your identity provider only. If it has been anywhere else, rotate it.
Keep two admins. The last-admin rule protects you, but two active admins make every change easier.

Scope: what SCIM does not do

Desk & Park provisions users only. Groups are not synchronised, and roles are not set through SCIM: everyone arrives as an Employee, and admins assign other roles in Desk & Park. Teams are not mapped either; the department is. There is no direct integration with HR systems; SCIM runs between your identity provider and Desk & Park. Entra ID and Okta are supported through their standard SCIM connections (a custom app in Entra, the SCIM test app or your own app in Okta), not through a certified gallery listing.

FAQ

Does SCIM cost extra in Desk & Park?

No. SCIM provisioning is available on every plan, including the free Start plan. Plans do not limit the number of users, so there is no cap on the accounts created through SCIM.

What happens to a leaver's permanent desk or parking spot?

When the identity provider deactivates or deletes the user, Desk & Park releases their permanent desk and parking assignments back to the shared pool and records which spaces were released in the audit log. Colleagues can book them straight away.

Is a deactivated user signed out immediately?

Yes. Deactivation revokes all of the person's sessions, including access tokens already issued, so they cannot keep using an open browser tab or phone.

Can we assign roles or sync groups through SCIM?

No. SCIM in Desk & Park handles users only. New accounts get the Employee role, and admins change roles in Desk & Park. Groups are not provisioned.

Do people need a password after being provisioned?

No. SCIM-created accounts have no password. People sign in through your organisation's single sign-on or with a one-time code sent by e-mail.