Automatic user provisioning FAQ
Common questions about System for Cross-domain Identity Management (SCIM) provisioning with the iGrafx platform.
All SCIM provisioning solutions
Does a removed or deleted user count toward a license for the 30 days before it's removed?
No — disabled users don't count toward license assignment limits.
How do I sign in once a user is provisioned?
SCIM is designed to work alongside SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. authentication. As long as the NameID from SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. matches the username provisioned through SCIM, the user can sign in with SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials..
What if a user already exists in the platform?
SCIM uses a directory system to keep users and groups separate. If the user already exists, SCIM doesn't recreate them; if not, the user is created in the SCIM directory.
What if a group already exists in the platform?
Group names need to be unique only per user directory, so all groups are created. Only users in the SCIM directory are added to SCIM groups, which are managed in your SCIM provider, not in iGrafx.
Why isn't a user recreated after I delete them in iGrafx?
The sync is one-way — changes in iGrafx don't update your SCIM source, where the user still shows as provisioned. Remove and re-provision the user, or restart provisioning in your source system.
We're managed by another directory sync system — how does that work with SCIM?
Migrating LDAP user synchronization to SCIM is supported. Migrating local users to SCIM users isn't currently supported.
Do you support other SCIM-compliant identity providers?
Yes — Okta is supported. Other providers that support the SCIM standard aren't actively supported; use the generic SCIM guide to test yours.
Do you support multiple SCIM identity providers in one iGrafx platform?
Yes.
What's the most common cause of a provisioning error during user creation?
Check your attribute mappings first. Then check the values themselves: a first or last name containing parentheses or brackets fails with a 400 invalidSyntax error, which is why a value like Jane (EXT) doesn't provision. Ordinary punctuation in names, such as apostrophes and hyphens, is fine — so map first and last name from the user's own name attributes rather than from a display name, which is where a suffix like (EXT) usually comes from.
invalidSyntax is returned for every 400, so read the response's detail field for the actual reason. For example, "A valid email address is required." means no primary work email reached iGrafx.
SCIM in Azure / Microsoft Entra ID
How often does Microsoft Entra ID update the platform?
Additions and group changes in Entra ID replicate to the platform within at most 40 minutes.
Can I provision immediately, without the 40-minute delay?
Yes — use Entra ID's provision-on-demand feature.
What happens when a user is removed or deleted from Microsoft Entra ID?
The user is disabled in the platform for up to 30 days, then permanently deleted. See Entra ID's de-provisioning documentation.
Are nested groups supported?
No. The iGrafx platform supports nested groups, but the Entra ID provisioning service can't read or provision users in nested groups.
Can we synchronize guest accounts?
Yes — guest accounts synchronize like normal users, with no extra changes.
Why do I see a "skipped" status in the logs?
A user already in the platform with all the correct data shows "skipped" on initial provisioning. It also appears when changes are made to Entra ID resources that aren't being synchronized.
Can I synchronize specific users or groups instead of the whole directory?
Yes — under Provisioning → Edit → Settings → Scope, select Sync only assigned users and groups, so only those added to the Users and groups blade are synchronized.
How long does the initial sync take?
Anywhere from 30 minutes to about 2 days, depending on how many users and groups you sync and how. See Microsoft's provisioning duration chart.