System for Cross-Domain Identity Management (SCIM) is an open standard that automatically creates, updates, and removes user accounts across your organization's software.
In enterprise password management, SCIM connects your Identity Provider (IdP) to your password manager, so access follows each person's employment status without manual admin work.
If you're wondering what SCIM is, here's the short answer: SCIM automates user provisioning and deprovisioning. When someone joins, changes roles, or leaves, your IdP sends that change to Dashlane, and their access updates to match. Dashlane supports SCIM through Dashlane Confidential SSO and SCIM Provisioning, works with Microsoft Entra ID, Okta, JumpCloud, and PingID, and keeps its zero-knowledge security architecture intact.
For IT and security teams, the stakes are practical. Every password manager account that outlives an employee's tenure is a gap in your access controls. This guide explains what SCIM is, how it differs from single sign-on (SSO), and how Dashlane supports it for enterprise teams.
What is SCIM?
SCIM stands for System for Cross-domain Identity Management. The Internet Engineering Task Force (IETF) publishes it as an open standard in RFC 7642, RFC 7643, and RFC 7644. It defines a common format for user identity data and a standard way for systems to exchange it.
In practice, SCIM uses a REST API and a shared schema. Your IdP acts as the source of truth. A connected app, such as a password manager, receives “create,” “update,” and “delete” requests whenever a record changes in the IdP.
You may also hear SCIM called automated user provisioning. Provisioning means creating and configuring accounts. Deprovisioning means removing access when someone no longer needs it.
How does SCIM work?
SCIM follows a simple lifecycle between your IdP and each connected app:
- Connect: An admin enters the app's SCIM endpoint URL and an API token in the IdP.
- Assign: The admin assigns users or groups to the app in the IdP.
- Sync: The IdP creates accounts in the app for every assigned user.
- Update: Changes to a user's profile or status in the IdP pass to the app.
- Deprovision: When someone is unassigned or deactivated in the IdP, the IdP tells the app to remove them.
Essentially, SCIM lets you use each member's status in your IdP to provision and deprovision members. Dashlane's Help Center covers the full details.
SCIM vs. SSO: What's the difference?
SCIM and SSO solve different problems, and they work best together. SSO controls how people sign in. SCIM controls who has an account in the first place.
| SSO | SCIM | |
|---|---|---|
| MAIN JOB | Signs users in with one set of credentials | Creates, updates, and removes user accounts |
| TRIGGERED BY | Each login attempt | Changes in your IdP |
| HELPS PREVENT | Weak and reused logins | Orphaned and unmanaged accounts |
| PROTOCOL IN DASHLANE | SAML 2.0 | SCIM |
| SETUP IN DASHLANE | Confidential SSO | Confidential Provisioning, with or without SSO |
Dashlane lets you set up SCIM provisioning without turning on SSO, so you can adopt each control at your own pace.
Why does SCIM matter for enterprise password management?
A password manager holds an organization's most sensitive credentials. That makes account lifecycle management a security control, not just an IT convenience.
SCIM helps in five ways:
- Faster, safer offboarding: Departing employees lose access as soon as your IdP deactivates them. Your team doesn't need a separate password manager step on the exit checklist.
- Quicker onboarding: New hires get a Dashlane account when you assign them the app, so they can start using the password manager on day one.
- Less admin work: IT stops adding and removing plan members by hand, which cuts errors and admin time as headcount grows.
- Cleaner access reviews: Your IdP stays the single source of truth for who has access, which supports audits under frameworks such as SOC 2 and ISO 27001.
- Fewer orphaned accounts: Manual processes miss people. Automated syncing closes gaps created by reorganizations, contractors, and acquisitions.
How does Dashlane support SCIM provisioning?
Dashlane offers SCIM provisioning through Dashlane Confidential SSO and SCIM Provisioning. Here's what that gives your admins:
- Dashlane Confidential SSO and SCIM Provisioning: Dashlane hosts the encryption service for you, which it recommends as the simplest and fastest setup. Dashlane stopped offering self-hosted SSO and SCIM for new setups after October 2025, though existing setups can continue.
- Zero-knowledge security architecture: The encryption service lets SSO and SCIM work without a Master Password. Neither Dashlane nor your IdP holds your encryption key, so a breach at either wouldn't expose vault data.
- Admin Console control: Admins generate the SCIM API token, verify the organization's email domain, and turn on automatic user provisioning from the Admin Console.
- SCIM with or without SSO: You can run SCIM provisioning on its own or alongside Confidential SSO.
- Visibility into unmanaged accounts: After you verify your domain, the Admin Console can export a CSV file of employees who have Dashlane accounts on your domain, logged in within the past 90 days, and haven't been invited to your plan.
Which identity providers work with Dashlane SCIM?
Dashlane works with many SAML 2.0 IdPs for SSO. SCIM support is narrower, as this table from the Help Center shows.
| IDENTITY PROVIDER | SSO | SCIM | OTHER DIRECTORY SYNC |
|---|---|---|---|
| Microsoft Entra ID (Azure) | Yes | Yes | Not applicable |
| Okta | Yes | Yes | Not applicable |
| JumpCloud | Yes | Yes | Not applicable |
| PingID | Yes | Yes | Not applicable |
| AD FS | Yes | No | Not applicable |
| Google Workspace | Yes | No | SAML group sync |
| Duo | Yes | No | Sync with connected IdP |
Support can change, so confirm your IdP in the Help Center before you plan a rollout. If your IdP isn't listed, contact Dashlane Support through the Admin Console.
How to set up SCIM provisioning in Dashlane
You need admin access to both the Dashlane Admin Console and your IdP. These steps follow the Dashlane SCIM Provisioning guide:
- In the Admin Console, go to the Integrations section, select Provisioning, then Confidential Provisioning, then Set up.
- Verify your organization's email domain when prompted.
- Under User Provisioning, select Generate Token and copy the SCIM API token.
- Turn on Activate automatic user provisioning.
- In your IdP, open the User Provisioning page. Paste the SCIM Endpoint from Dashlane into the SCIM URL field, and enter the token with Bearer Token selected.
- Turn on user provisioning, and turn off group provisioning via SCIM.
- Assign users or groups to your Dashlane app in the IdP, then test the connection.
What SCIM doesn't cover in Dashlane
SCIM handles the user lifecycle. A few details are worth planning for before you roll it out:
- Sharing groups stay separate. Dashlane sharing groups are created and managed in Dashlane. They don't merge or sync with SCIM groups, and the Confidential SCIM protocol doesn't support sharing group creation.
- Email changes don't sync automatically. If a member's email changes in your IdP, Dashlane doesn't update it on its own.
- Mobile Conditional Access has a limit. Confidential SSO doesn't support Microsoft Conditional Access on mobile devices.
- Some IdPs aren't covered. SCIM isn't supported with AD FS, Google Workspace, Duo, or SSO that uses non-SAML protocols such as OpenID Connect.
Pair SCIM with other Dashlane admin controls
SCIM controls who has access. Other Dashlane features show how that access is used and where risk remains:
- Password Health: Each plan member gets a Password Health score, and admins can monitor password health in plan members' Business Spaces.
- SIEM integrations: Dashlane integrates with security information and event management (SIEM) tools so you can monitor team activity in real time.
- Credential Risk Detection: Monitor for risk even when employees aren't using Dashlane, and reduce threats by improving visibility.
- Admin-assisted recovery. Admins can turn on another recovery option for plan members, and requests are stored in the Activity log tab of the Admin Console.
Automate access with Dashlane
SCIM turns your IdP into the control point for who can use your password manager. Dashlane adds the zero-knowledge security architecture, Admin Console controls, and visibility tools to make that access safe and easy to manage.
Get a Dashlane demo to see SCIM provisioning in action.
Frequently asked questions about SCIM
What does SCIM stand for?
SCIM stands for System for Cross-domain Identity Management. It's an open standard that automates the creation, update, and removal of user accounts between an Identity Provider (IdP) and connected apps.
Is SCIM the same as single sign-on (SSO)?
No. SSO controls how people sign in, and SCIM controls who has an account. Dashlane supports both, and you can set up SCIM provisioning with or without SSO.
Does Dashlane support SCIM?
Yes. Dashlane supports SCIM provisioning through Dashlane Confidential SSO and SCIM Provisioning for organizations on a Password Management or Credential Protection plan.
Which identity providers does Dashlane support for SCIM?
Microsoft Entra ID (Azure), Okta, JumpCloud, and PingID are supported for SCIM provisioning. AD FS, Google Workspace, and Duo support SSO but not SCIM.
Can I use SCIM without SSO in Dashlane?
Yes. You can set up SCIM provisioning without turning on SSO. Generate a SCIM API token in the Admin Console, then enter the SCIM endpoint and token in your IdP.
Does SCIM weaken Dashlane's zero-knowledge security architecture?
No. Dashlane uses an encryption service, so SSO and SCIM work without a Master Password. Neither Dashlane nor your IdP holds the encryption key, so a breach at either wouldn't expose vault data.
What does SCIM do when an employee leaves?
When you deactivate or unassign the employee in your IdP, the IdP sends that change to Dashlane through SCIM. The member is then removed from Dashlane without a manual step by your admins.
Sign up to receive news and updates about Dashlane
