Manage SCIM Users in Skyhigh

When a group is pushed from IdP to Skyhigh, its users appear on the User Management > Users and Roles > Users tab and are in a zero-access state. 

The following items help you to understand the SCIM-provisioned user status in the User Management > Users and Roles > Users tab when a group is pushed from an IdP: 

• Active. Green in the Active column indicates the user is active, while grey indicates an inactive user.
• User Type. Displays SCIM-provisioned user to indicate that the identity is managed and synchronized via an external Identity Provider (IdP). The table below describes the icons used in Skyhigh to identify each user type.

Icon	User Type
	Primary user
	Manually added user
	Manually added user and administrator
	SCIM provisioned user
	SCIM provisioned user and administrator

• Access. Set to a No Access state by default. Click Edit to assign roles to the linked group.
• Linked Group. Displays the name of the synchronized Identity Provider (IdP) group that the user belongs to. Displays the group name only after the group has been assigned to the Skyhigh application within your IdP and successfully pushed via SCIM sync.
• Roles(s). Displays No Roles Assigned by default. Once a specific role and permission set is assigned to the corresponding linked group, the inherited role name will automatically populate here.
• Permissions. Displays the specific access privileges associated with the user. Once a role is mapped to the linked group, the inherited permissions will automatically populate and be listed here.
• Last SCIM Sync. Displays the timestamp for the last SCIM sync.
• Actions
  • Edit. Click to assign roles to the linked group. For details, see Configure Role-Based Access Control (RBAC) for SCIM Groups.

You can map Skyhigh roles to SCIM- provisioned users.

Follow the steps below to configure a role for a linked group in Skyhigh:

1. Go to Settings > User Management > Users and Roles > select the Roles tab.
   
   
    
2. Click Edit corresponding to the role. To create a role, see Create a Role.
   
   
    
3. On the Edit Role page, click Select Groups from the Link Role to Group(s) field.
   
   
    
4. On the Select Group panel, the groups that are pushed from the IdP to Skyhigh appear. Select the desired group. Switch on the toggle Show Selected Only to view only the selected linked groups.
   
   
    
5. Click Done. The Linked Group column now displays the specific linked group mapped to the Skyhigh role on the Users and Roles > Roles tab.
   
   ​

Now you can view the Role(s) column with the specific role assigned to the corresponding linked group on the Users and Roles > Users tab. 

When a user is created in IdP and added to the application, the Skyhigh Users and Roles > Users tab populates the synced users. The users will be in a zero-access state.

The following images illustrate an individual user within the Identity Provider (IdP) who is assigned to the Skyhigh application and how synchronized users automatically appear and are managed within the Skyhigh User Management console.

The following items help you to understand the SCIM-provisioned individual user status in the User Management > Users and Roles > Users tab:

• Active. Green in the Active column indicates the user is active, while grey indicates that the user is inactive.
• User Type. Displays SCIM-provisioned user to indicate that the identity is managed and synchronized via an external Identity Provider (IdP).
• Access. Set to a No Access state by default, as roles cannot be directly assigned to an individual SCIM-provisioned user.
• Linked Group. If the user is an SCIM-provisioned individual user, this field will be grayed out.
• Roles(s). Displays No Roles Assigned because permissions for SCIM users are inherited through role-to-group assignments rather than individual assignments.
• Last SCIM Sync. Displays the timestamp for the last SCIM sync.
• Actions
  • Edit. You cannot edit the roles and permissions for the SCIM-provisioned individual user. However, you can edit the toggle button to activate or deactivate the user and assign jurisdictions. To know more about jurisdiction details, see About Data Jurisdictions.