Do I need SCIM for deprovisioning users automatically?

Not always — but SCIM is the most common and reliable way to automate user deprovisioning.

Short answer

If you want users to be automatically removed/disabled in an app when they leave your identity provider (IdP), SCIM is usually what you use.

What SCIM does

SCIM (System for Cross-domain Identity Management) lets your IdP:

• create users automatically
• update user attributes
• deactivate or delete users automatically

When you might not need SCIM

You may not need SCIM if:

• the app has its own built-in deprovisioning API
• you only need manual offboarding
• you’re using Just-in-Time provisioning only and don’t need lifecycle management
• your SaaS vendor handles deactivation through another integration method

Common alternative

Some apps support:

• SAML/SSO for login
• plus a separate admin API or sync job for deprovisioning

In that case, SCIM is not required, but you still need some mechanism to disable access automatically.

Practical rule

• Need automatic create/update/delete across users? Use SCIM.
• Only need login/authentication? SCIM is not necessary.
• Need automatic deprovisioning specifically? You need SCIM or another lifecycle-management integration.

If you tell me which IdP and application you’re using, I can say whether SCIM is required in that setup.