> ## Documentation Index > Fetch the complete documentation index at: https://docs.iru.com/llms.txt > Use this file to discover all available pages before exploring further. # SCIM Directory Integration with OneLogin > Configure SCIM directory integration between OneLogin and Iru Endpoint. Automatically provision and deprovision users and groups via the SCIM protocol. ### About SCIM Directory Integration with OneLogin SCIM Directory Integration with OneLogin in Iru Endpoint allows you to set up SCIM-based user directory synchronization between OneLogin and Iru Endpoint, enabling automatic user and group provisioning and deprovisioning. ### How It Works The SCIM integration creates a secure connection between OneLogin and Iru Endpoint, enabling automatic synchronization of user and group data. When users or groups are added, modified, or removed in OneLogin, these changes are automatically reflected in Iru Endpoint through the SCIM protocol. ### Prerequisites * Be sure to review the supported user and group attributes listed in the [SCIM Directory Integration](/en/endpoint/integrations/scim/scim-directory-integration#scim-schema-and-supported-attributes) article. ### Get the SCIM Token and API URL Complete these steps in Iru Endpoint first. You will need the SCIM access token and API URL when configuring OneLogin. For full details, see the [SCIM Directory Integration](/en/endpoint/integrations/scim/scim-directory-integration) article. In Iru Endpoint, click your name at the bottom of the left navigation, then select **Integrations**. Screenshot of the account menu with Integrations option highlighted Click **Discover integrations** in the upper-right of the Integrations page. On the **SCIM protocol** tile, click **Add and configure**. Add new integration page with SCIM protocol tile and Add and configure button Click **Get started**. Enter a unique name for the SCIM integration. Click **Generate token**. The SCIM integration uses an HTTP authorization header with a Bearer Token. Configure a SCIM user integration screen with name field and Generate token button Click **Copy token**. The token will not be visible again after you click Done. Store it securely, as you will need it in the **OneLogin** tab. Confirm that you have copied the token by checking the box, then click **Done**. You will return to the **Integrations** page. Copy token and configure with your identity provider dialog with Copy token button Click the **ellipsis** on the SCIM directory integration you created. Select **View Details**. Directory integrations list with SCIM integration and ellipsis menu showing View details, Rename, Rotate token, Delete Copy the SCIM API URL (e.g. `https://subdomain.api.iru.com/api/v1/scim`). Your identity provider will require this. The URL displayed in your tenant may still show the `api.kandji.io` domain. The `api.kandji.io` version of the SCIM API URL will also work for this purpose. Click **Close**. View user integration details modal with SCIM API URL and copy button Keep the token and API URL available, then switch to the **OneLogin** tab to create and configure the SCIM app integration. Complete the **Iru Endpoint** tab first to obtain the SCIM token and API URL. You will enter these in the steps below. ### Creating the SCIM Integration in OneLogin Log into your OneLogin admin console. (example: [https://accuhive.onelogin.com/admin2](https://accuhive.onelogin.com/admin2)) In the top navigation, hover over **Applications**. Click **Applications** in the dropdown menu. OneLogin top navigation with Applications menu Near the top-right, click **Add App**. OneLogin Applications page with Add App button In the text field, enter **SCIM Provisioner with SAML (SCIM v2 Enterprise)**. Click on **SCIM Provisioner with SAML (SCIM v2 Enterprise)**. OneLogin Add App search with SCIM Provisioner with SAML option ### Configuring SCIM Settings Once in the **SCIM Provisioner with SAML (SCIM v2 Enterprise)** application, use the following steps to configure the SCIM settings. The following steps include provisioning users and groups (roles). #### Application Information (optional) Update the app **Display Name** to something like **Iru Endpoint SCIM Provisioner** (optional) Choose whether to make the app visible in the OneLogin portal. (optional) Add an icon. (optional) Add a description. After completing the basic configuration, click **Save**. OneLogin SCIM app basic configuration with Display Name and Save #### Parameters Navigate to the **Parameters** page. Click the add **(+)** button on the right. OneLogin Parameters page with add parameter button Enter **email.value** into the **Field name**. OneLogin new parameter with email.value field name Click **Save**. Select **Email** from the Value dropdown. OneLogin email.value parameter with Email value selected Click **Save**. #### Configuration Navigate to the **Configuration** page. In the **SCIM Base URL** field, paste the SCIM API URL you copied from the **Iru Endpoint** tab (e.g. `https://subdomain.api.iru.com/api/v1/scim`). The `api.kandji.io` version of the SCIM API URL will also work for this purpose. In the **SCIM Bearer Token** field, paste the token you obtained in the **Iru Endpoint** tab. Click **Enable** to turn on the API Connection. Click **Save**. OneLogin Configuration page with SCIM Base URL and Bearer Token fields #### Provisioning Go to the **Provisioning** page. Select the box to **Enable provisioning**. Uncheck the boxes next to **Create user**, **Delete user**, and **Update user**. For the option **When users are deleted in OneLogin, or the user's app access is removed...**, choose **Delete**. For the option **When user accounts are suspended in OneLogin...**, choose **Suspend**. Now, in the top-right, click **Save** to keep the initial configuration. OneLogin Provisioning page with Enable provisioning and user operations ### Provisioning Users and Roles to Iru Endpoint Use the following steps to send users and OneLogin roles to Iru Endpoint via the SCIM integration. OneLogin roles are synonymous to groups in Iru Endpoint, and are assigned to the SCIM configuration. When users are assigned to roles in OneLogin, they are then pushed to Iru Endpoint. Additionally, any roles assigned to the SCIM app are pushed to Iru Endpoint as groups. #### Creating a Role In the top navigation, hover over **Users**. In the dropdown menu, click **Roles**. Click **New Role**. Give the Role a name. Select the apps that should be assigned to the role. In this case, we selected the SCIM app. Click **Save**. #### Assigning Users to the Role Click back into the role that was just created. Click **Users**. Under **Users Added Automatically**, click **New Mapping**. Give the Mapping a name. Create the conditions that meet your needs. For this example, choose **Group membership** as the criteria, but you can use other criteria like department. Under **Actions**, choose the role that should be applied. Click **Save**. OneLogin only allows a user to be member of one group, so you can think of OneLogin groups like an attribute that describes the user similar to department or location. Use OneLogin roles if a user needs to be a member of more than one "group". For more information on Group provisioning, please see OneLogin's documentation [here](https://developers.onelogin.com/scim/create-app). If desired, users can also be added to the SCIM apps manually from each user's record. #### Adding a Rule to the SCIM App Use the steps below to push one or more roles (Iru Endpoint groups) to Iru Endpoint in the OneLogin SCIM app. In the SCIM app, click **Rules**. Click **Add Rule**. Give the rule a name. Under **Actions**, choose **Set Groups in** from the first dropdown. Select **Map from OneLogin**. In the **For each** field, choose **role** from the dropdown. In the **with value that matches** field, enter the SCIM Role to push to Iru Endpoint as a group. Click **Save**. ### Pushing Updates **Syncing**: User and group syncing is one-way, meaning the SCIM app will send user information to Iru Endpoint only when there is new or updated information to be sent. For this reason, a "Sync Now" option is not needed in the Iru Endpoint web app. If the SCIM app is updated in OneLogin, you will need to save the change and then use the **Reapply entitlement mappings**. Hover over the **More Actions** menu. Click on the **Reapply entitlement mappings** option.