🔬 SCIM integration for SSO

With single sign-on, your identity provider decides who can log in to your tchop app. What SSO alone cannot do is tell tchop when someone leaves. SCIM closes that gap: when you disable a person in your directory, tchop removes their access automatically.

What SCIM adds to your SSO setup

When you use SSO, tchop creates a user the first time that person logs in. From then on, the account stays in tchop until someone removes it. If an employee leaves and you disable them in your identity provider, they can no longer start a new SSO login, but their tchop account and any open sessions remain until an admin cleans up by hand.

SCIM (System for Cross-domain Identity Management) is an open standard for keeping user accounts in sync between systems. With SCIM switched on, your identity provider calls a tchop endpoint whenever a user's status changes in your directory. If you remove someone from the tchop app assignment or disable their account, tchop revokes their access at the next sync. Their sessions in the web app and the mobile apps end, and they can no longer sign in.

Optionally, SCIM can also create users and keep their profile data up to date before they log in for the first time. You do not need this to automate offboarding.

How it works with Microsoft Entra ID

The steps below use Microsoft Entra ID as the example. If you use a different identity provider with SCIM support, talk to us and we will walk you through the equivalent setup.

1. tchop sends you a SCIM endpoint URL (the tenant URL) and a secret token for your organisation.

2. In the Microsoft Entra admin center, open your existing tchop Enterprise Application and go to Provisioning. Set the mode to Automatic and enter the tenant URL and the secret token. Use "Test connection" to check that Entra can reach tchop.

3. Assign the users or the group that should have access to tchop. The same assignment that controls SSO access now also controls provisioning.

4. Start provisioning. Entra runs an initial sync and then an incremental sync roughly every 40 minutes. You can also provision a single user on demand from the portal.

From then on, removing a user from the assignment or disabling their account in Entra removes their tchop access at the next sync.

Decisions to make before setup

A few points depend on how your organisation works, so we agree on them with you first.

Which tenant and which group

Confirm that the Entra tenant you use for tchop SSO is the one that will run provisioning. Then name the group or app assignment that defines "has access to tchop". Removal from that group is what triggers access removal.

How users are matched

The attribute your identity provider sends as the SCIM user name must be the same email address your SSO login delivers. That is how tchop matches incoming SCIM data to existing accounts.

What happens when someone leaves

You choose between two behaviours. Banning keeps the user record in tchop and revokes access. Deleting removes the user from your tchop organisation. Which one fits depends on your data retention rules.

How much SCIM should do

You can limit SCIM to access removal, or also let it create users and update profile data such as name or department.

Network restrictions

Entra's provisioning service calls tchop from Microsoft's own IP ranges, not from your company network. If you restrict access to tchop by IP address, the SCIM endpoint must stay reachable from those Microsoft ranges. Otherwise provisioning fails.

What tchop provides

• the SCIM tenant URL for your organisation

• a secret token to authenticate provisioning requests, issued once and rotated on request

• support during the connection test and the initial sync

• confirmation once the first offboarding has been verified end to end

What changes for your users

Nothing in daily use. People log in through SSO exactly as before. The only difference shows up when someone leaves: their tchop access ends with the next sync, without anyone on your team having to remember it.

Getting started

SCIM is available for organisations that already use SSO with tchop. Contact your tchop representative with your answers to the decisions above, and we will set up the endpoint and run the first sync with you.