SCIM
A REST and JSON standard (RFC 7643 and RFC 7644) for automatically provisioning and deprovisioning users and groups across systems.
SCIM 2.0 defines a schema for User and Group resources (RFC 7643) and a protocol (RFC 7644) for create, read, update, patch and delete. The identity provider (Okta, Entra ID) is the client; each SaaS app exposes a SCIM endpoint and receives changes as people join, move and leave.
SSO alone authenticates users but leaves accounts behind: someone who leaves can still use API keys, sessions or local passwords in an app. SCIM closes the loop by deactivating the account and its group memberships when HR offboards them.
Problems in practice: apps that implement only create, PATCH semantics that differ between providers, a SCIM bearer token with full admin rights stored without rotation, and deprovisioning that disables login but leaves existing sessions and tokens alive.