Skip to content
New AI Custom Form BuilderDescribe the intake form. It ships branded and end-to-end encrypted.AI Custom Form Builder is here See it build
Engineering

Automated User Provisioning with SCIM

We’re excited to announce an update to our SCIM-based user management API that gives IT teams centralized control over admin rights in SendSafely via Okta.

Brian Holyfield · 2 min read

We’re excited to announce an update to our SCIM-based user management API that gives IT teams centralized control over admin rights in SendSafely via Okta. You can now manage SendSafely admin access the same way you manage users, roles, and lifecycle events through Okta. By defining a user profile extension, SendSafely can automatically grant or revoke Admin privileges based on a new “isAdmin” attribute sent through SCIM.

Here’s how it works:

When enabled for your organization, SAML users have their Admin rights managed exclusively via SCIM. The Admin toggle in the SendSafely Enterprise Console is disabled. Non-SAML users (such as break-glass username/password accounts) continue to be managed directly in the SendSafely Enterprise Console. This ensures that identity-managed users follow your IdP rules, while still preserving flexibility for emergency or service accounts.

To keep administrators informed, SendSafely automatically sends an email notification whenever a user’s Admin rights are changed, providing clear visibility into access changes.

This feature is available on request and must be enabled by the SendSafely Support team. To get started, and configure the user extension in okta, follow the steps outlined in this article.


SendSafely: Integrated File Transfer for the Apps you Love

If you are looking for a secure way to transfer files with customers or business partners, our platform might be right for you. Contact us today to request a demo and free trial subscription.

Request a Demo

Frequently asked questions

Can I manage SendSafely admin rights through Okta?

Yes. With SCIM, SendSafely can grant or revoke Admin privileges based on an “isAdmin” attribute sent from Okta through a user profile extension. IT teams can manage admin access alongside users, roles, and lifecycle events in their identity provider. See SendSafely’s SSO and SCIM features.

How does the SendSafely isAdmin SCIM attribute work?

When isAdmin is true, the user is granted Admin rights in SendSafely. When it is false, the user does not have Admin rights. If the attribute is missing or null, SendSafely ignores it and leaves the user’s current Admin status unchanged.

What happens to the Enterprise Console Admin toggle when SCIM admin management is on?

For SAML users, the Admin toggle in the SendSafely Enterprise Console is disabled and Admin rights are managed only through SCIM. Non-SAML users, such as break-glass username and password accounts, are still managed directly in the Enterprise Console.

Does SendSafely notify anyone when a user's admin rights change?

Yes. SendSafely automatically sends an email notification whenever a user’s Admin rights are changed. This gives administrators clear visibility into access changes, which matters when Admin rights are being set automatically from the identity provider.

How do I enable SCIM-based admin management in SendSafely?

The feature is available on request and must be enabled by the SendSafely Support team. Once it is enabled, you configure the user profile extension in Okta by following the steps in SendSafely’s help center article.