Guru supports automatic user and group provisioning with the SCIM (System for Cross-domain Identity Management) standard. To set up automatic provisioning, your team will need to first have Single Sign On (SSO) set up and configured for your team.
You must be an Admin to set up SCIM for your team.
What does automatic provisioning do? Why is it useful?
With automatic provisioning enabled, Guru Admins can add, remove, and assign users to groups both inside their identity provider and in Guru. This process allows larger teams to manage their users and groups in one place.
When can I set up automatic provisioning?
Before you set up automatic provisioning, please confirm the following:
Your team must have Single sign-on enabled.
You must be an Admin.
If you don't see the SCIM toggle available for your team, please contact your team's Account Manager or email@example.com so we can work with you to ensure you have the correct feature access.
Setting up Automatic Provisioning
After our team has enabled automatic provisioning for you, follow the below steps:
Navigate to the SSO/SCIM page
Toggle the button next to Authorize SCIM Provisioning to ON
Members added through automatic provisioning are billable as soon as they sign in for the first time. The cost of new member accounts will be prorated for the remainder of your current billing period.
Instructions specific for your Identity Provider
The provisioning setup varies depending on the identity provider (IdP) your team uses. Guru is featured as a member of the Okta network, but this functionality works for any IdP that supports the SCIM 2.0 standard. Here is a list of IdPs we're compatible with:
If your IdP is not listed above and you need help navigating set up, please reach out to Guru at firstname.lastname@example.org.
Guru currently does not support automatic provisioning through Office 365. We only support SSO through Google and standard SAML using a third party identity provider.
Guru also supports Group Linking which creates a 1:1 linkage that will merge a SCIM group (and users within it) into the Guru Group, while maintaining the Collection permissions of the Guru Group. This allows for easy user management through SCIM.
You don't need to do anything to enable this, existing Guru Groups will show within the IDP Group Link menu. If a Guru Group has the same name as the group being linked it will automatically select that linkage.
After SCIM is enabled:
Automatic provisioning allows Admins to manage Guru team members more efficiently. Upon enabling auto-provisioning:
Users, Groups, and Group assignments from your IdP will come into Guru immediately. Any Users, Groups, and Group assignments with pre-existing exact matches in Guru will be merge. Once they've merged, these become uneditable in Guru.
User or Groups in Guru that do not match Users or Groups in your IdP will not sync into your IdP provider. You will be able to manage these Users and Groups directly in Guru.
Admins will be able to distinguish Users and Groups from your identity provider from Guru Users and Groups via the syncing symbol.
Any Cards that are unassigned due to the removal of a user or group can be re-assigned in the Card Manager.
When users are de-provisioned through SCIM they will be immediately deleted in Guru. Reassign user responsibilities such as Card verification before removing them from SCIM.