Your org changes.

SCIM provisioning connects Basedash to an identity provider so user and group records can follow the organization's directory. Basedash supports SCIM 2.0 user and group provisioning for creating, updating, deactivating, and reactivating users, along with group and membership synchronization. This reduces app-by-app identity administration as people join, change teams, leave, or return.

Basedash SCIM works with Okta, Microsoft Entra ID, and other identity providers that support compatible SCIM 2.0 provisioning. The exact controls for assigning users and pushing groups vary by provider, but each compatible provider can manage the supported Basedash user, group, and membership lifecycle through SCIM.

SCIM helps the identity lifecycle scale with analytics adoption. Instead of maintaining Basedash membership separately for every personnel change, teams can manage users and groups from their existing directory. That gives Heads of BI, VPs of Data, IT, and security a clearer source of truth for who belongs in the organization while reducing manual rollout work.

When the identity provider sends a SCIM deactivation to Basedash, the corresponding organization membership is marked inactive. If the IdP later sends a reactivation, Basedash restores that same membership instead of requiring a new account. The timing depends on when the identity provider sends and Basedash processes the provisioning change; SCIM deactivation is not instant session invalidation.

No. SCIM synchronizes groups and their memberships, but it does not assign Basedash resource permissions or provision administrator roles. After groups arrive from the identity provider, a Basedash admin separately decides which data sources, dashboards, and other resources each group can access. Directory membership is automated while resource authorization remains an explicit Basedash decision.

The Basedash documentation includes the configuration guide, supported user and group behavior, token management, discovery endpoints, limitations, and troubleshooting guidance. Organization admins can use that guide when they are ready to connect Okta, Microsoft Entra ID, or another compatible identity provider.

Each control has a separate role. SSO handles authentication, SCIM manages the supported user, group, and membership lifecycle, role-based access control governs workspace, group, and resource access, and row-level security limits which rows users can see. SCIM does not assign Basedash resource permissions or provide compliance on its own.

SCIM is publicly packaged as an Enterprise feature. Enterprise teams can connect a compatible identity provider and use SCIM to manage user lifecycle, groups, and memberships alongside Basedash's other identity and security controls. Contact the Basedash team to confirm packaging for a specific deployment and plan the identity-provider setup.