Setting Up SCIM Provisioning for Span

Last updated: October 27, 2026

SCIM connects your identity provider (Okta, Microsoft Entra ID, or Google Workspace) to Span through Span's identity partner, WorkOS, so Span access is granted and removed automatically as people join and leave. SCIM never creates people in Span: it gives access to people who already exist in Span.

Why it matters

  • For IT: you manage who can use Span from the same place you manage every other app. Offboarding in your identity provider removes Span access without a separate step.

  • For Span admins: you stop toggling Access Type by hand for each new hire and leaver.

How it works

Span keeps three roster jobs apart. Single Sign-On controls how people sign in. SCIM controls who has access to Span. Directory Sync controls who reports to whom: people, teams, and org structure.

  • Span matches by email. For each active user in your identity provider's Span app, Span looks for a person in your Span organization with the same email address.

  • A match gets access. Span sets that person's Access Type to Account and marks them as managed by SCIM. In People Management, the Access Type field shows a SCIM badge and reads "Configure via SCIM - This user is managed through your identity provider."

  • No match, no change. If no Span person has that email, nothing happens. Add the person to Span first (by hand, by CSV, or through your HR system), and SCIM gives them access on the next sync.

  • Deactivated or unassigned users lose access. When you deactivate someone or remove them from the Span app, Span removes their account access. Their person record, history, and metrics stay in Span.

  • People outside your identity provider keep their access. Someone you added to Span by hand who was never managed by SCIM keeps the Access Type you set.

  • What SCIM does not do. It does not create people, and it does not set job titles, teams, managers, or permissions. It never changes anyone's team or manager.

Setup

You need the Manage Integrations permission (Owners, Admins, and Integration Admins have it by default) and admin access in your identity provider. Span turns on the SCIM Setup page for organizations that want SCIM. If you don't see it under Settings, ask your Span account team.

1. Get your SCIM credentials

  1. In Span, go to Settings → SCIM Setup (under Organization).

  2. Click Start setup. This opens the WorkOS setup portal.

  3. The portal gives you the SCIM base URL and a bearer token to paste into your identity provider. Return to the same portal later to rotate or revoke the token.

Security note: treat the bearer token as a secret. If you need to pass it to a colleague, use a password manager or secure vault, not Slack or email.

2. Configure SCIM in your identity provider (Okta example)

A. Open the Span application

  1. Go to Applications → Span.

  2. Click Edit.

  3. Under Provisioning, set Provisioning Type to SCIM.

  4. Save. This reveals the Provisioning tab.

B. Configure the SCIM connection

In Provisioning → Integration:

  • SCIM Connector Base URL: paste the base URL from the portal.

  • Authentication Mode: HTTP Header.

  • Authorization: Bearer <token>, using the bearer token from the portal.

  • Unique Identifier: email.

Save your changes.

C. Enable supported actions

In Provisioning → To App, enable Create Users, Update User Attributes, and Deactivate Users. Deactivation covers removal and offboarding. Group push is not required.

"Create Users" lets Okta send users to Span. Span still doesn't create people from them; it only grants access to matching people.

3. Assign users to the Span app

Assign individuals directly, or assign a group (recommended). Assignment grants access to people who already exist in Span with the same email. Assigned users with no matching Span person get no access until someone adds them to Span. Removing an assignment removes access.

4. Ask Span to turn on provisioning

Connecting your identity provider is not the last step. Span turns on SCIM provisioning for your organization separately, and access changes don't flow until it does. Contact your Span account team once your directory is connected.

5. Test provisioning

  1. Pick a real person who already exists in Span with Access Type set to No account, and assign them to the Span app.

  2. On the SCIM Setup page, click Sync now to start a sync, or wait for your identity provider to push the change.

  3. In Settings → People Management, confirm their Access Type shows Account with the SCIM badge, and that they can sign in.

  4. Remove the assignment and confirm their access is removed.

SCIM Setup statuses

Status

What it means

Not configured

No setup has started. Click Start setup.

Pending setup

Setup started but no directory exists yet. Click Continue setup.

Validating

"Waiting for a successful sync before it becomes active."

Setup complete

"Your organization has an active SCIM directory."

Invalid credentials

"Your SCIM credentials are no longer valid. Re-run the setup wizard to generate fresh credentials." Click Re-run setup and paste the new token into your identity provider.

Inactive

A directory exists but is not active.

Sync timing: SCIM changes are processed automatically. Most updates arrive within minutes, depending on your identity provider.

Things to know

  • Email is the match key. If someone's email changes in your identity provider, the Span person with the old address stops matching and loses the access SCIM gave them. The new address grants access only to a Span person who already has it. Update the person's email in Span (People Management → Edit) to match.

  • Admins can't change Access Type for SCIM-managed people. Span shows "Cannot change access type for users managed by SCIM." Change the assignment in your identity provider instead.

  • SCIM doesn't send invite emails. People who get access through SCIM sign in at the Span sign-in page.

  • Permissions stay in Span. SCIM doesn't assign permission groups, and your identity provider's groups don't map to them. In Span, a permission group can add people automatically with rules on job title, job family, or level, plus Managers fills itself with anyone who has direct reports.

  • Teams and reporting lines come from Directory Sync, not SCIM. Your HR system sync is a separate setup.

  • SCIM and SSO are separate. SCIM decides who has access. SSO decides how they sign in.

  • Worked example: you assign a group of 120 people to the Span app. 100 of them already exist in Span, so those 100 get access on the next sync. The other 20 get nothing until someone adds them to Span. Later, you deactivate 3 leavers in Okta, and Span removes their access while keeping their history.

Related articles

  • Setting up SSO with Span

  • How do I add a new user to Span? (in the customer library)

  • Roles & Permissions in Span (in the customer library)

  • Using Directory Sync for Roster Management (in the customer library)

Need help?

Contact your Span account team or reach out to support@span.app.