# SCIM Provisioning

> Tier: Enterprise Exclusive

Automatically create, update, and deactivate Raycast for Enterprise accounts from your identity provider with SCIM, keeping access in sync as your team changes.

> [!NOTE]
> Support for Enterprise features in Raycast for Windows has not yet been added. Contact us if you require these features in your organization.

SCIM (System for Cross-domain Identity Management) allows you to automatically provision and deprovision Raycast user accounts from your identity provider. This ensures that when employees join or leave your organization, their Raycast access is updated automatically.

**Supported operations:**

- **Create Users:** Automatically create Raycast accounts when users are assigned in your IdP
- **Update Users:** Sync profile changes from your IdP to Raycast
- **Deactivate Users:** Automatically remove Raycast access when users are unassigned

## Provision with Okta

1. In the Application General tab → App Settings press Edit and select SCIM for Provisioning

![Okta SCIM Provisioning option](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/scim-provisioning-1.png)

2. Press Save
3. Navigate to the Provisioning tab and press Edit
4. Fill out the SCIM Connection settings
   - SCIM connector base URL:
     ```text
     https://www.raycast.com/scim/{organization-handle}
     ```
   - Unique identifier field for users: `userName`
   - Supported provisioning actions: Select the first 3 items
   - Authentication Mode: `HTTP Header`
   - Authorization: Paste the SCIM Token that Raycast shared with you through 1Password

![Okta SCIM Connection settings](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/scim-provisioning-2.png)

5. On the To App section, select the first three checkboxes: Create Users, Update User Attributes and Deactivate Users

![Okta SCIM To App provisioning settings](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/scim-provisioning-3.png)

6. Press Save
7. Assign the Application to users to ensure their accounts are created in Raycast

## Provision with Microsoft Entra ID

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), navigate to Entra ID → Enterprise apps and select the Raycast enterprise application
2. Open the Provisioning tab and press New configuration
3. Fill out the Admin credentials
   - Select authentication method: `Bearer authentication`
   - Tenant URL:
     ```text
     https://www.raycast.com/scim/{organization-handle}
     ```
   - Secret token: Paste the SCIM Token that Raycast shared with you through 1Password
4. Press Test connection to confirm that Entra ID reaches the Raycast SCIM endpoint
5. After the test passes, press Create

![Entra ID new provisioning configuration with the Raycast tenant URL and secret token](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/scim-entra-1.png)

6. Still in the Provisioning tab, expand the Mappings section
   - Confirm that Provision Microsoft Entra ID Users is enabled
   - Confirm that Provision Microsoft Entra ID Groups is disabled, because groups are not supported yet

![Entra ID provisioning Mappings section with user provisioning enabled and group provisioning disabled](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/scim-entra-2.png)

7. Press Provision Microsoft Entra ID Users
   - Check that `userName` maps to `userPrincipalName` with Matching precedence `1`
   - Confirm that Create, Update and Delete are checked under Target Object Actions

![Entra ID attribute mapping for users with the userName to userPrincipalName match and all target object actions checked](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/scim-entra-3.png)

8. Go back to the Provisioning tab and expand the Settings section
   - Scope: `Sync only assigned users and groups`
   - Send an email notification when a failure occurs: unchecked
   - Prevent accidental deletion: unchecked
9. Set Provisioning Status to On and press Save at the top

![Entra ID provisioning Settings section with scope set to assigned users and provisioning status on](https://fz1sd71lwhbqy6sh.public.blob.vercel-storage.com/raycast/images/teams/scim-entra-4.png)

10. Assign the Application to users in the Users and groups tab to ensure their accounts are created in Raycast


---

## Need Help?

Contact Raycast Support if you have any questions or would like help with SCIM Provisioning. Use the **Send Feedback** command directly in Raycast to report bugs and billing issues, log feature requests, or any other queries you would like to speak to us about.

You can view all Raycast Support contact options at https://manual.raycast.com/contact-support