SCIM (System for Cross-domain Identity Management) allows organizations to automatically manage author accounts in Easygenerator through their Identity Provider (IdP), such as Okta or Microsoft Entra ID.

With SCIM enabled, organizations can automatically provision new authors, update user information, and deactivate or reactivate author accounts based on changes made in their Identity Provider.

Note: To enable SCIM, SSO integration for authors must already be in place for the account.

Why use SCIM?

SCIM helps organizations simplify user management by:

Automatically adding new authors to Easygenerator.
Reducing the need for manual invitations.
Ensuring user access is aligned with your organization’s identity management system.
Automatically deactivate users who leave the organization.
SCIM builds on top of Single Sign-On (SSO) — your organization must already have SSO configured with your Identity Provider before SCIM can be enabled, since the authors SCIM provisions sign in using that same SSO connection.

To set up SCIM User Provisioning for your organization, please contact your Customer Success Manager or reach out to us at [email protected].

Connecting your Identity Provider

Once SSO is in place, your IT administrator (or your Identity Provider admin) sets up a SCIM connector so your IdP can talk directly to Easygenerator. This section covers how that connection works and what you'll need to configure it.

How SCIM works, technically

SCIM 2.0 is a standard protocol that lets your IdP communicate with Easygenerator to manage the author account lifecycle automatically.

Your IdP connects to Easygenerator's SCIM API using either OAuth 2.0 Client Credential or Bearer token authentication.
Users assigned to the Easygenerator application in your IdP are automatically created as authors in Easygenerator with the member role; they can sign in through Single Sign-On (SSO) and start creating content immediately, without waiting for a manual invitation.
When user information changes in your IdP, the updates are automatically synchronized to Easygenerator as First or Last name. For the update, the Email is not supported as the email attribute is the premier attribute in Easygenerator BD.
When a user is removed or deactivated in your IdP, the corresponding author account in Easygenerator is automatically deactivated.

The diagram below summarizes this exchange between your Identity Provider and Easygenerator.

Figure: SCIM provisioning and deactivation flow between your IdP and Easygenerator.

Role-based provisioning is not supported.

Every user assigned in your IdP application is provisioned as an author in Easygenerator with the member role, role assignment isn't mapped from IdP groups or attributes.

SCIM technical details

Authentication modes

SCIM supports the following authentication modes, selected from the Authentication mode dropdown when setting up the connector:

OAuth 2.0 Client Credential (recommended)
Your IdP exchanges a Client ID and Client Secret at Easygenerator's Token URL for a short-lived access token, then sends that access token as a Bearer credential on every SCIM request. This is the recommended mode for most IdPs, since access tokens expire and are refreshed automatically.

Bearer token
Your IdP sends a single, long-lived Bearer token directly in the Authorization header on every SCIM request, there's no separate token exchange step. This is simpler to configure, but because the token is long-lived, treat it like a password: store it securely and rotate it if it's ever exposed.

SCIM endpoints

Purpose	URL
Base URL	https://auth.easygenerator.com/public-api/v1/scim2
Token URL (OAuth 2.0 only)	https://auth.easygenerator.com/public-api/v1/scim2/token

OAuth 2.0 Client Credential

Your IdP requests an access token from the Token URL using the Client ID and Client Secret. That access token is then used in the Authorization header for all SCIM API calls.

Credential	Description
Client ID	Issued by Easygenerator for your SCIM integration.
Client Secret	Issued by Easygenerator for your SCIM integration. Store it like a password.

Bearer token

Your IdP sends a single, long-lived Bearer token directly in the Authorization header on every SCIM request — there's no separate token exchange step. Because it's long-lived, store it securely and rotate it if it's ever exposed.

What we share with your IT team

What you hand over depends on the authentication mode:

OAuth 2.0 Client Credential

• Client ID

• Client Secret key

• Base URL

• Token URL

Bearer token

• Bearer token

• Base URL

Where to enter these: In the IdP's SCIM app settings, the Base URL is typically the "SCIM connector base URL" field, and the Client ID/Secret or Bearer token go into the app's authentication settings. Field names vary slightly between Okta, Microsoft Entra ID, Google, and OneLogin.

Supported Identity Providers

SCIM is an open standard (defined in RFC 7643 and RFC 7644), and Easygenerator's SCIM endpoint implements that standard rather than IdP-specific integrations. In practice, this means:

Known, commonly used IdPs, Okta, Microsoft Entra ID, Google Workspace, and OneLogin, connect without any special handling.
Any other IdP that implements the SCIM 2.0 standard should also work, if it follows the standard's conventions for authentication and user resource operations. No custom development on Easygenerator's side is required for a compliant IdP.

How SCIM works, technically (in general)

SCIM 2.0 is a standard protocol for exchanging identity information over HTTPS. Your IdP acts as the SCIM client, and Easygenerator acts as the SCIM server.

Authentication: your IdP authenticates to Easygenerator using OAuth 2.0 Client Credentials or Bearer token before making any request.
User provisioning: the IdP sends requests to Easygenerator's SCIM endpoint to create, update, and deactivate author accounts as changes happen in the IdP.
Response: Easygenerator returns a response indicating whether each operation succeeded.
Sync frequency: your IdP determines how often it syncs users — for example, every few minutes or immediately on change.

How does SCIM user deactivation work?

When a user is removed from the Easygenerator application or group in your Identity Provider, their Easygenerator account is automatically deactivated.

A deactivated author:

Can no longer sign in to Easygenerator.
Is logged out of active sessions.
Cannot access authoring features or courses.

For Organization admins: the deactivated users will remain visible under the inactive authors in My organization. Their courses, comments, and contributions remain available.

Manage deactivated authors

Deactivated authors appear in the Inactive tab under My Organization.

Organization admins can use this tab to:

Review all deactivated authors.
Check the date when an author was deactivated.
See how many courses an author owns.
Transfer courses and media ownership when needed.
Remove deactivated authors from the organization.

Transfer courses from a deactivated author

Before removing a deactivated author who owns courses, admins should transfer ownership of their content.

To transfer ownership:

Go to My Organization.
Open the Inactive tab.
Click on the three dots on the right side of the deactivated author.
Select Transfer courses.
You will be able to select the courses and the account you would like to transfer them to.
Then, click on the Transfer button

Once ownership for all courses has been transferred, the author can be removed from the organization.

Bulk manage deactivated authors

Admins can manage multiple deactivated authors at once from the Inactive tab.

You can:

Select multiple deactivated authors.
Filter authors based on whether they own courses.
Remove eligible authors from the organization.
Export a CSV file with deactivated author information.

Note: Authors who still own courses need to have their content transferred before they can be removed.

Removing deactivated authors from the Organization

Removing a deactivated author from the organization revokes their access to the organization and hides them from the author list while their account and historical contributions (such as comments and course activity) are preserved.

Full account deletion is handled by Easygenerator support.

To remove a deactivated author from the organization:

Go to My Organization.
Open the Inactive tab.
Click on the three dots on the right side of the deactivated author you want to remove.

You can also select multiple accounts to remove them by checking the boxes on the left.
Click Remove from organization.
Confirm the action.

Reactivating a user

If a user is added back to the Easygenerator application in your Identity Provider, Easygenerator automatically reactivates their account.

After reactivation:

The user can sign in again.
Their previous content access is restored.
They are removed from the Inactive tab.

Important notes

SCIM provisioning and deactivation apply to authors only.
Learners and learner results are not managed through SCIM.
If your learner SSO connection also happens to support SCIM, we can try to enable it for learners. But Easygenerator doesn't have the same application-level handling for learner accounts (such as deactivation behavior) that it has for authors.
Deactivation does not delete accounts or content.
Account deletion can only be performed by Easygenerator support.
Role-based provisioning is not supported; every account SCIM provisions gets the default member author role. Adjust roles manually inside Easygenerator afterward if needed.

FAQ

What is the difference between deactivating and deleting an author?

Deactivation prevents an author from accessing Easygenerator while keeping their account and content available. Removing an author from the organization disconnects them from the organization, while full account deletion is handled by Easygenerator support.

Can a deactivated author access Easygenerator?

No. A deactivated author can no longer sign in, access the editor, or collaborate on courses until their account is reactivated through the Identity Provider.

What happens when a deactivated author appears in courses?

Deactivated authors may still appear in places where their previous contributions exist.

They are marked as Deactivated so collaborators can understand their current status.

Their comments and contributions remain visible.

What happens to a deactivated author's courses and content?

A deactivated author's courses, comments, and contributions are not deleted. Organization admins can review the author's content and transfer ownership when needed.

Which authentication modes does SCIM support?

Easygenerator's SCIM API supports two authentication modes: OAuth2.0 Client Credential (recommended — uses a Client ID and Client Secret to obtain a short-lived access token) and Bearer token (a single long-lived token sent with every request). Your Identity Provider admin chooses the mode when setting up the SCIM connector.

Do I need Single Sign On (SSO) to use SCIM?

Yes. SCIM builds on your existing SSO connection, so SSO must already be configured for your organization before SCIM can be enabled.

Can I connect an Identity Provider other than Okta or Microsoft Entra ID?

Yes. Easygenerator's SCIM API follows the SCIM 2.0 standard, so any Identity Provider that implements this standard — including Google Workspace, OneLogin, or a custom IdP — can connect, as long as it follows the standard's conventions.