---
title: "Introducing SCIM Provisioning in ClickHouse Cloud"
description: "ClickHouse Cloud introduces SCIM 2.0 provisioning, making the identity provider the single source of truth for user membership and role assignments. Previously, SAML SSO handled authentication but left user invites and role updates as manual tasks, creating security risks. SCIM provisioning automatically syncs user create, update, and delete operations from the IdP using standard SCIM 2.0 endpoints, maps IdP groups to custom ClickHouse roles via stable external IDs, supports up to two API keys for rotation, and provides audit logging for all provisioning actions. The feature requires an active SAML connection, is limited to verified domain SSO users, excludes system roles like Admin, and revokes all keys if SAML is disabled. It is generally available for Enterprise and BYOC organizations, validated with Okta and Microsoft Entra ID, and eliminates manual invite and deprovisioning tasks."
---

# Introducing SCIM Provisioning in ClickHouse Cloud

[Clickhouse](https://yomu.fyi/company/clickhouse) · Sep 30, 2026

**Type:** Announcement

## Summary

ClickHouse Cloud introduces SCIM 2.0 provisioning, making the identity provider the single source of truth for user membership and role assignments. Previously, SAML SSO handled authentication but left user invites and role updates as manual tasks, creating security risks. SCIM provisioning automatically syncs user create, update, and delete operations from the IdP using standard SCIM 2.0 endpoints, maps IdP groups to custom ClickHouse roles via stable external IDs, supports up to two API keys for rotation, and provides audit logging for all provisioning actions. The feature requires an active SAML connection, is limited to verified domain SSO users, excludes system roles like Admin, and revokes all keys if SAML is disabled. It is generally available for Enterprise and BYOC organizations, validated with Okta and Microsoft Entra ID, and eliminates manual invite and deprovisioning tasks.

## Context

SAML SSO handled authentication but left membership management as a manual process, creating security risks from lingering accounts and manual invite overhead.

## Approach / What changed

ClickHouse Cloud implements a SCIM 2.0 endpoint (RFC 7644) with API key authentication. Admins enable SCIM in organization settings, generate scoped API keys, and configure their IdP (e.g., Okta, Entra ID) to push groups. IdP groups are mapped to custom ClickHouse roles via a SCIM group column, using stable external IDs to survive renames. User deprovisioning uses PATCH/DELETE operations, and all actions are audit logged. SAML is a prerequisite, and the feature is limited to verified domain SSO users and custom roles only.

## Takeaways

- SCIM 2.0 provisioning automatically creates, updates, and deletes ClickHouse Cloud users based on IdP assignments, eliminating manual invite and deprovisioning.
- IdP groups can be mapped to custom ClickHouse roles, and the mapping uses stable external IDs, so renaming a group in the IdP does not break the link.
- SCIM requires SAML and only works with verified domain email addresses; system roles like Admin cannot be assigned through SCIM, and API keys are scoped solely to the SCIM endpoint.

## FAQ

### Does SCIM require SAML?

Yes, SCIM cannot be enabled without an active SAML connection. Removing the SAML connection immediately revokes all SCIM keys and turns off provisioning.

### Can I assign admin roles via SCIM?

No, SCIM only manages custom roles. System roles like Admin are invisible to SCIM and cannot be assigned through it.

### What happens if I lose the SCIM key secret?

You can hold up to two keys at a time and rotate them. The secret is shown only once during creation, so you should copy it immediately or download the credentials file.

**Tags:** [ClickHouse](https://yomu.fyi/topic/clickhouse), [Identity](https://yomu.fyi/topic/identity), [SAML](https://yomu.fyi/topic/saml), [SCIM](https://yomu.fyi/topic/scim)

- Source: [Clickhouse](https://clickhouse.com/blog/introducing-scim-provisioning-in-clickhouse-cloud)
- Source URL: https://clickhouse.com/blog/introducing-scim-provisioning-in-clickhouse-cloud
- Ingested by Yomu: 2026-09-30T18:00:09.341Z

[Read original post](https://clickhouse.com/blog/introducing-scim-provisioning-in-clickhouse-cloud)