02.05 · Concept
Invitations, SCIM & Enterprise Lifecycle
Explain why an enterprise customer will not accept 'invite your colleagues by email', and what SSO plus SCIM actually provision and deprovision.
Enterprise user access must follow the company directory, not ad hoc email invites. SSO proves identity at login, while SCIM keeps application accounts, profile data, groups and access state in sync with central HR and identity workflows, including suspension and deactivation when people leave or change roles.
What this lesson answers
- why enterprise apps need SCIM not email invites
- what SSO manages versus what SCIM manages
- how SCIM deprovisioning works for former employees
Notes
For a small team, inviting colleagues by email feels natural: a user types an address, the recipient accepts, and the app creates an account. Enterprise customers usually cannot accept that as the primary lifecycle mechanism because identity is not managed by individual employees. The company already has a central identity provider such as Okta, Microsoft Entra ID, or Google Workspace, and it needs one place where HR-driven joins, moves, and departures control access to every approved application.
SSO and SCIM solve different parts of that problem. SSO answers “who is this person right now,…
References
Common questions
- Why will an enterprise customer reject email invitations?
- Email invitations put account creation in the hands of individual users, outside the company’s normal joiner, mover and leaver process. Enterprise customers need access controlled from a central identity provider, usually tied to HR and security policy, so approved applications reflect who should have access without relying on manual invitation flows.
- Does SSO automatically create and remove users?
- SSO mainly handles authentication. It lets the application trust that the identity provider has verified the person at login time. It may create a local account just in time, depending on the product, but it does not by itself maintain group membership, update profile data, or cleanly deactivate application access over time.
- What does SCIM actually provision in an application?
- SCIM lets the identity provider push the desired user and group state into the application. That includes creating accounts, updating attributes, assigning or removing group membership, suspending users, and deactivating accounts. The application then reconciles those changes as an administrative control plane rather than a user-driven signup path.
Short definition: what is Invitations, SCIM & Enterprise Lifecycle?