Provisioning with SCIM

Provisioning is part of the Enterprise plan, alongside single sign on. With it, your identity provider keeps CostReveal's team in step with your directory over SCIM 2.0: it adds people when they are assigned the application, updates their name and address, deactivates them when they leave, and sets their role from the groups they are in.

Only addresses on your verified company domain can be provisioned, the same domain single sign on routes by.

Connect your identity provider

1. In CostReveal, open Settings, Provisioning and choose Create token. Copy the token: it is shown once. Copy the SCIM base URL too.
2. Give both to your identity provider, as below.

There is one token at a time. Replace token stops the old one at once, so provisioning pauses until your identity provider has the new one. Stop provisioning refuses its next request; everyone it provisioned stays, and you manage their access in CostReveal from then on.

Okta

In the CostReveal application's Provisioning tab, under Integration:

• SCIM connector base URL: the SCIM base URL.
• Unique identifier field for users: userName.
• Supported provisioning actions: Push New Users, Push Profile Updates and Push Groups.
• Authentication Mode: HTTP Header, with the token as the bearer token.

Then, under To App, turn on Create Users, Update User Attributes and Deactivate Users. Push the groups you want to give roles to from the Push Groups tab.

Microsoft Entra ID

In the CostReveal enterprise application, open Provisioning, set Provisioning Mode to Automatic, and enter the SCIM base URL as the Tenant URL and the token as the Secret Token. Choose Test Connection, then save.

CostReveal stores userName, active, displayName, emails[type eq "work"].value, name.givenName, name.familyName, name.formatted and externalId. The other attributes of Entra's default mappings are accepted and ignored, so there is no need to remove them. Assign the users and groups to provision, then start provisioning.

Roles from groups

Groups your identity provider pushes appear under Settings, Provisioning, Groups. Choose Change on a group to give it a role, and for a role that does not see every project, the projects its members see.

Until any group has a role, provisioned people start as viewers of nothing, and you set their roles on the Team page as for anyone else. Once a group has one:

• Everyone provisioned takes the highest role of their groups, and sees the projects of all of them.
• Someone in no group with a role is a viewer of nothing, so leaving a group in your identity provider takes away what it gave.
• Their role and projects can only change through their groups. The Team page shows them as managed by your identity provider.
• Owners are never changed by a group. You choose owners in CostReveal, so your identity provider can never take the organization from them.

Deactivating and removing people

When your identity provider deactivates someone, they keep their place on the Team page, marked Deactivated, with no access. A session your identity provider signed them in with ends at once; any other session loses the organization on its next request. Reactivating them in your identity provider restores their access.

When it removes someone, they leave the organization. Their CostReveal account stays, with any other organization it belongs to.

While provisioning is on, people it manages are removed in your identity provider, not on the Team page, and nobody it deactivated can be invited back around it. Your identity provider can never deactivate or remove the organization's last owner. An erasure request is honored whoever manages the person.

What is recorded

Everything your identity provider changes is in the audit log, as Identity provider: who it provisioned, deactivated, reactivated or removed, and every change of role that came from a group.