SSO and SCIM setup

Skrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.

SSO and SCIM are on the Agency (enterprise) plan. Once configured, your identity provider is the source of truth for who has an account and what role they hold.

SSO

1. Pick the protocol. Settings → SSO → New. SAML for legacy IdPs, OIDC for modern ones.
2. Paste the metadata. Skrum shows its ACS URL and entity id; paste the IdP metadata or endpoints. The IdP certificate (SAML) and client secret (OIDC) are envelope-encrypted at rest.
3. Enforce. Once "Test connection" succeeds, turn on enforce-SSO. The workspace owner keeps a break-glass fallback.

SCIM

1. Mint a token. Settings → SCIM → New token. Shown once; store it in your IdP.
2. Point the IdP. Base URL: https://<your-skrum>/api/scim/v2. Bearer auth uses the token.
3. Provision. Users created in your IdP appear in Skrum with the configured default role and the seat cap enforced.

FAQ

• Enforce-SSO locks me out — what now? The workspace owner keeps a password fallback and can rotate the SSO config.
• Can SCIM tokens be rotated? Yes — mint a new one and delete the old.

See also: Skrum documentation