SCIM provisioning

Parent: Atlas Federated Authentication · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for SCIM provisioning; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] The SCIM protocol is an HTTP-based standard for provisioning and managing identity data, supporting creation, modification, retrieval, and discovery of resources like Users and Groups. Sources: https://www.rfc-editor.org/rfc/rfc7644.html [source]
[low] The SCIM bulk operation is an optional feature allowing large collections of resource operations in a single request, with service providers defining maximum operation counts and payload sizes. Sources: https://www.rfc-editor.org/rfc/rfc7644.html [source]
One source states SCIM is not available for MongoDB Atlas, while another states it is available in the Okta Integration Network with SCIM 2.0 support. Sources: https://www.stitchflow.com/scim/mongodb, https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]

Structure and components

[low] SCIM service providers must support TLS 1.2 and require transport-layer security because SCIM resources contain sensitive information such as passwords. Sources: https://www.rfc-editor.org/rfc/rfc7644.html [source]

How it works

[low] Adding SCIM provisioning support to Atlas SSO is on the roadmap, which would allow automatic updates to users and group assignments in Atlas when changes occur in the IdP. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881 [source]

Problems, failure modes and limitations

[low] Username and email are immutable after account creation in MongoDB Atlas and cannot be updated via SCIM. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] Okta Provisioning agent 3.1.0 introduces strict SCIM error validation to ensure standard compliance and resolves an issue preventing the agent from starting. (verified as of 2026-10-15) Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] HTTP PATCH is an optional SCIM server function for updating attributes, and PATCH requests are treated as atomic, restoring the original resource if any operation encounters an error. Sources: https://www.rfc-editor.org/rfc/rfc7644.html [source]
[low] Groups pushed from Okta are created as teams in MongoDB Atlas; team names must be unique within the organization and are not case-sensitive. Names can contain numbers but can't contain special characters other than :, ,, @, -, and _. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]

Facts and statements

[low] MongoDB Atlas does not offer native SCIM provisioning on any plan, including Enterprise, and relies on Just-In-Time (JIT) provisioning for user creation upon first login. (verified as of 2026-10-15) Sources: https://www.stitchflow.com/scim/mongodb [source]
Some sources state MongoDB Atlas has no native SCIM provisioning and requires third-party tools, while other sources describe Okta and SAP integrations that provide SCIM 2.0 support for Atlas. Sources: https://www.stitchflow.com/scim/mongodb, https://www.okta.com/integrations/mongodb-atlas/, https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[high] MongoDB Atlas supports Just-In-Time (JIT) user provisioning, which is enabled by default and creates new users in Atlas after they authenticate if they do not already exist. (verified as of 2026-10-15) Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial, https://www.stitchflow.com/scim/mongodb [source]
[low] MongoDB Atlas uses OAuth 2.0 Client Credentials to authenticate SCIM integrations, requiring a Service Account with a Client ID and Secret, and an account with Organization Owner privileges. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-integrate.htm [source]
[low] In non-governance organizations, no user parameters are updatable via SCIM, whereas in governance organizations, organization and project roles can be updated. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] Only the team name can be updated via SCIM, and teams do not support a description field. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] MongoDB Atlas is available in the Okta Integration Network (OIN) with SCIM 2.0 Provisioning support, automating user lifecycle and access management between Okta and Atlas. (verified as of 2026-10-15) Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] Pulumi Cloud is available in the Okta Integration Network with SCIM 2.0 provisioning support, enabling automated user onboarding, profile updates, and offboarding. (verified as of 2026-10-15) Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] MongoDB Atlas supports SAML 2.0, OIDC, and OAuth 2.0 for Single Sign-On (SSO) but lacks automated deprovisioning, requiring manual removal of users and database permissions. Sources: https://www.stitchflow.com/scim/mongodb [source]
[low] SCIM service providers may support additional query parameters and should ignore unrecognized ones for versioning compatibility, while successful PUT operations return a 200 OK code with the entire resource. Sources: https://www.rfc-editor.org/rfc/rfc7644.html [source]
[low] In Okta integrations, new users assigned to the app are pushed to MongoDB Atlas as organization invitations, requiring an email-format username and at least one organization role. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] In non-governance organizations, the ORG_MEMBER role is assigned by default to new users, while in governance organizations, an organization role is required and project roles are optional. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] Assigning an organization-level role in MongoDB Atlas automatically assigns the corresponding project-level roles. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] New users provisioned through Okta receive the default organization role, while existing imported users keep their current roles. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] Deactivating a user or disabling their access to the app in Okta deletes the user from the MongoDB Atlas organization. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] Okta imports active and pending user accounts from MongoDB Atlas and downloads profile updates to apply to corresponding Okta profile fields. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] App entitlements for MongoDB Atlas in Okta can be managed at the organization and project levels, requiring Okta Identity Governance. Sources: https://help.okta.com/en-us/Content/Topics/provisioning/mongodbatlas/mongodbatlas-supported-features.htm [source]
[low] The Okta MongoDB integration supports SAML-based SSO and SCIM-based automated user provisioning to centralize account lifecycle management and govern role entitlements. Sources: https://www.okta.com/integrations/mongodb-atlas/ [source]
[low] The SAP integration has been migrated to use the SCIM 2.0 API, updating the connector's internal HTTP helper to support this standard. (verified as of 2026-10-15) Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] Okta On-prem SCIM Server agent 1.8.0 introduces support for single-value entitlements in SCIM 2.0. (verified as of 2026-10-15) Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] The Application username format field in the Okta Admin Console appears by default, allowing admins to configure custom mappings for the SCIM userName attribute. Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] The Okta On-prem SCIM Server agent has been replaced by the Okta On-prem SCIM agent to reduce dependencies and allow for new features. (verified as of 2026-10-15) Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] Okta provides a seamless ISV experience for SCIM integrations, enabling independent software vendors to build and manually test SCIM integration metadata before submission to the OIN. Sources: https://help.okta.com/en-us/content/topics/releasenotes/archive/oce-relnotes-2026.htm [source]
[low] MongoDB Atlas SSO currently supports JIT provisioning, meaning users provisioned from SSO can only be updated on login, including group assignments. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881 [source]
[low] MongoDB Atlas customers can achieve role elevations via their IdP, but this is constrained by JIT provisioning which only updates users on login. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881 [source]

Related concepts

SCIM — is a part of SCIM provisioning
provisioning — is a part of SCIM provisioning

Children

No children recorded.

← the whole tree · 3D view· how to read this page