Platform / Lifecycle and SCIM
Access that follows people from first day to last.
Bring people in over SCIM or CSV, let group rules hand out apps, and offboard someone everywhere with one action.
- JoinsSCIM or CSV creates the person. Group rules assign apps
- MovesAn attribute changes, rules recalculate, connected apps update over SCIM
- LeavesDeactivate once. Sessions end, refresh tokens are revoked, and OIDC apps with back-channel logout are told
In from your source of truth
Point an HR system or another directory at IdRa’s SCIM server, or import a CSV with a preview before anything is written.
- Inbound SCIM 2.0 for users, with PATCH and deprovisioning
- CSV import with column mapping, dry run and error export
- Group rules that assign people by attribute
Out to the apps you connect
Outbound SCIM creates, updates, deactivates and reactivates accounts in connected apps, with retries and the last error visible on each link.
- Outbound SCIM provisioning per app
- Push chosen groups, matching an existing group of the same name
- SCIM attribute mapping per app, copying fields without transforms
A last day that actually ends access
Deactivate someone once. IdRa ends their sessions, revokes their refresh tokens and tells OIDC apps with back-channel logout to sign them out. SAML apps keep their own sessions.
- Time-limited group membership
- Access requests with an approver and an expiry
- Event hooks to your own systems, signed with HMAC and retried
Standards it speaks
- SCIM 2.0
- Signed webhooks
Not here yet
- Workday and other HR connectors, and provisioning to apps without SCIM
- Importing accounts back from apps, and no-code workflows
- Scheduled automations such as “suspend after 90 inactive days”
- Marking suspended people inactive in downstream apps: outbound SCIM still sends them as active
We’d rather you read this now than find it in a pilot. See the full comparison.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.