Syncing profile attributes with SCIM

When you provision users into Guru with SCIM, Guru stores the profile attributes your identity provider (IdP) sends, such as job title, department, manager, and work location, on each person's Guru profile. Knowledge Agents can use these attributes to give answers that fit the person asking.

Your IdP admin decides which attributes to send. If you don't use SCIM, nothing changes.

---

Understanding which attributes Guru stores

Guru reads these standard SCIM attributes and stores them on the person's profile.

First name, last name, and display name come through SCIM with no extra setup. Guru reads only the work address and work phone, never home or mobile details.

Show on the profile page. The Guru profile page shows a fixed set of fields. Of the attributes SCIM sends, that's job title, work location, and manager.

Available to Knowledge Agents. Every other attribute is stored on the profile and available when someone asks a Knowledge Agent about it, even though it doesn't appear on the page.

Custom fields

Automatic custom fields. Employee number, cost center, user type, preferred language, locale, and nickname are stored as custom fields with no extra setup.

Custom fields by request. Guru stores any other attribute your IdP sends, such as a custom HR field. To use one with Knowledge Agents, contact Guru Support with the attribute names. Guru adds a label for each one on your workspace, up to 50. Custom fields don't appear on the profile page.

Understanding which value wins

For each profile field, Guru uses the first value it finds in this order:

1. HRIS sync. Guru's native HRIS sync, if your team has one.
2. SCIM. The value your IdP sends.
3. Manual entry. What the person typed in Guru.

A value from the HRIS sync or SCIM locks the field, so people can't edit it in Guru. If you turn SCIM off, profiles rebuild without SCIM values and the fields go back to your people to edit. Guru keeps the data, so turning SCIM back on restores it.

---

Setting up profile attributes

Before you start, make sure SCIM provisioning is on for your workspace. Learn more in Setting up SSO and SCIM.

Then gather these items:

• Attribute list. For each field you want in Guru, the name of the IdP attribute that holds it today, for example department or a custom attribute like legalEntity.
• Test users. Two or three users with clear values, so you can check the first push before applying updates to everyone.

Sending attributes from any SCIM IdP

Guru is built on the SCIM standard, so any SCIM IdP can send these attributes.

1. Add each attribute. In your IdP, add the attribute to the Guru app's profile using the SCIM attribute and schema from the reference table below.
2. Map your values. Map each user attribute in your directory to the matching SCIM attribute.
3. Push the values. Send the update for your assigned users.
4. Verify. Check one test user before rolling out to everyone. See Verifying your setup.

Attribute reference

Use these values when your IdP asks for an attribute name and schema. They must match exactly, including case.

For any other attribute, use the attribute name as the external name and urn:ietf:params:scim:schemas:extension:custom:2.0:User as the schema. Then contact Guru Support with the list so Guru can add a label for each one.

---

Frequently asked questions about SCIM profile attributes

Do I need to turn on profile attributes?
No separate setting. Profile attributes work for every workspace with SCIM provisioning turned on. Your IdP needs to send the attributes, and in Okta that means adding and mapping them on the Guru app, then choosing Apply updates now to re-push existing users.

Do I need the new Okta app?
No. The existing Guru app works with attributes added by hand. The new app adds schema discovery, but there's no upgrade path, so moving means removing the old app and setting up SSO and provisioning again.

Why do I see "Invalid authentication credentials" in the new Okta app?
The API Token field expects your SCIM username and token joined by a colon, like username:token. The token alone fails.

Why aren't department, entity, and custom fields on the profile page?
The Guru profile page shows a fixed set of fields. Those attributes are stored on the profile and available through Knowledge Agents. To check them, ask an agent a question like "What department am I in according to my profile?"

Where do entity and sub-department come from?
Entity reads the organization attribute and sub-department reads division. Map your own IdP attributes to those two.

What does the manager field need?
The manager's unique ID from your IdP in manager.value. In Okta, that's the Okta user ID, which starts with 00u. A name, email, or employee number doesn't work.

What happens if I have both an HRIS sync and SCIM?
Guru fills each field from the first source that has a value: HRIS sync, then SCIM, then manual entry. SCIM fills whatever your HRIS sync leaves empty.

Can SCIM fill the Team or start date fields?
Not by default, because neither has a built-in SCIM attribute. They come from your HRIS sync or manual entry. If you want SCIM to fill one, contact Guru Support. Guru can add a mapping for your workspace that points the field at the attribute your IdP uses.

Can I send a custom attribute that SCIM doesn't define?
Yes, with an app that lets you add attributes by hand, such as your existing Okta app. Add it with the attribute name as the external name and urn:ietf:params:scim:schemas:extension:custom:2.0:User as the schema. Guru stores it right away. To use it with Knowledge Agents, contact Guru Support to add a label (up to 50 per workspace). The new Okta app doesn't support non-standard attributes.

What happens if I turn SCIM off?
Profiles rebuild without SCIM values and the fields go back to your people to edit. Guru keeps the data, so turning SCIM back on restores it.