Skip to main content
Devin Enterprise supports SCIM 2.0 for automatic user and group provisioning. With SCIM, your identity provider (Okta, Microsoft Entra ID, or any SCIM 2.0-compliant IdP) pushes changes to Devin in real time — users are created before their first login, deprovisioned users lose enterprise membership immediately, and group memberships stay in sync without waiting for the next login. SCIM complements SSO. SSO is not required to use SCIM, but it is highly recommended.
Login-based just-in-time (JIT) provisioning should be turned off when using SCIM. Otherwise groups re-sync on every login and conflict with the groups SCIM pushes.

​
What SCIM Manages

SCIM-provisioned groups appear as IdP groups in Devin, so you can map them to enterprise roles and org access the same way as groups synced from SSO logins. Unlike login-synced groups, renaming a SCIM group in your IdP preserves its role and org mappings in Devin.

​
Step 1: Get Your SCIM Credentials

  1. In Devin, go to Settings → Enterprise → Membership and select the Members tab
  2. Scroll to the User and IdP group provisioning section at the bottom of the Members tab
  3. Copy the SCIM base URL
  4. Under SCIM bearer token, click Generate token and copy the bearer token
Generating a token automatically turns off just-in-time (JIT) provisioning so IdP group memberships are managed through SCIM only. If you still want login-based group syncing, you can turn the Just-in-time (JIT) provisioning toggle back on in the same section, though this is not recommended while SCIM is in use.
The bearer token is only shown once. Store it securely. You can rotate or revoke it from the same settings section at any time.

​
Step 2: Configure Your Identity Provider

SCIM is set up as a separate application from your existing Devin SSO app.Create the application
  1. In the Okta Admin Console, go to Applications → Applications and click Browse App Catalog
    Browse App Catalog in the Okta Applications page
  2. Search for SCIM 2.0 Test App (OAuth Bearer Token)
    Searching for the SCIM 2.0 Test App (OAuth Bearer Token) integration
  3. Click Add Integration and name it for easy reference (e.g. Devin (SCIM))
    Add Integration for the SCIM 2.0 Test App (OAuth Bearer Token)
Configure the application
  1. Open the app → Provisioning → Integration, click Configure API Integration, and check Enable API integration
    • SCIM 2.0 Base Url: the SCIM base URL from Devin
    • OAuth Bearer Token: the bearer token from Devin
    • Click Test API Credentials — this should succeed — then Save
    Configuring the SCIM API integration with the base URL and bearer token
  2. Open the app → Provisioning → To App, click Edit, enable Create Users, Update User Attributes, and Deactivate Users, then click Save
    Enabling Create Users, Update User Attributes, and Deactivate Users
  3. Open the app → Sign On, click Edit, set Application username format to Email, and click Save
    Application username format set to Email in the Sign On settings
  4. Open the app → Provisioning → To App, scroll to the attribute mappings, and click Go to Profile Editor
    Attribute mappings table with the Go to Profile Editor button
  5. In the Profile Editor, click Mappings
    Mappings button in the Okta Profile Editor
    • On the first tab (Okta user to app), set all mappings to Do not map except appuser.givenName → firstName, appuser.familyName → lastName, and appuser.email → email, then click Save Mappings
      First mapping tab with givenName, familyName, and email mapped
    • On the second tab (app to Okta user), set all mappings to Do not map except user.firstName, user.lastName, and user.email, then click Save Mappings
      Second mapping tab with firstName, lastName, and email mapped
Assign users and groups
  • Assign users (and groups) under the Assignments tab
  • To sync groups to Devin, also push them under the Push Groups tab
A user’s userName must be their email address, and must match the work email that is provisioned. This is why the Okta application username format is set to Email, and why the Entra userName and emails[type eq "work"].value mappings must point to the same attribute. Mismatched values are rejected by Devin’s SCIM endpoints.

​
Step 3: Map Groups to Roles

Assigned users are provisioned into your Devin enterprise with the default Enterprise Member role — before they ever log in. Map provisioned groups to roles and orgs under Settings → Enterprise → Membership, in the Groups (IdP) tab.

​
How Provisioning Interacts with SSO Login

  • Users provisioned via SCIM can log in via SSO immediately; no invite is needed
  • Deactivating a user in your IdP removes their enterprise membership right away; reassigning them restores it
  • Group memberships pushed via SCIM take effect immediately, without waiting for the user’s next login
  • With just-in-time (JIT) provisioning off, SCIM is the only source of IdP group memberships
  • Users created earlier by just-in-time provisioning or manual invites keep working; assign them in your IdP so SCIM manages them