VeryBusy supports SCIM 2.0 (System for Cross-domain Identity Management), so your identity provider (IdP) can automatically create, update, and deactivate VeryBusy accounts for your team.
SCIM Provisioning is an Enterprise-plan feature. If you're on Studio or Pro and want to enable it, contact us at enterprise@verybusy.io to move to Enterprise.
Supported identity providers: Okta and Microsoft Entra ID (formerly Azure AD). The setup steps below apply to both — start with the general flow, then jump to the section for your specific provider.
Who can access SCIM Provisioning
For general Owner vs. Member permissions across workspace settings, see Workspace Settings: An Overview. For SCIM specifically:
Workspace owner (Enterprise plan): full access — can enable/disable SCIM, generate and rotate the token, and view Sync History.
Other workspace members (Enterprise plan): see the Provisioning section in a locked, read-only state with the message "Request your workspace owner to contact VeryBusy to grant you access." They can't enable or view token details themselves.
Studio or Pro plan (any role): the section is locked behind an upgrade prompt — no token management is accessible.
Need someone other than the owner to manage this? This is common when the workspace owner isn't the person actually running SSO/IT for the company. If you want to give access to an IT admin or another teammate, have the workspace owner contact us at support@verybusy.io and we'll help set that up.
How it works
Assigning a user to the VeryBusy app in your IdP creates their account (if needed) and adds them to your workspace — the same outcome as manually adding a member, just automatic. New members get a password-reset email.
Updating a user's profile (name or email) in your IdP updates it in VeryBusy.
Deactivating or unassigning a user in your IdP immediately removes their access to the workspace and all its projects. They stay in your members list, marked inactive — see "Deactivation and removal" below.
Reactivating a user in your IdP restores their access exactly as it was, including all project memberships.
Before you begin
You must be the workspace owner on an Enterprise workspace to configure provisioning. If you don't see the Provisioning tab and believe you should, contact us at support@verybusy.io.
Have your IdP admin credentials ready (Okta admin, or Entra ID Application Administrator).
Step 1 — Get your SCIM credentials in VeryBusy
This part is identical no matter which IdP you use — you only do it once, in VeryBusy.
Go to Workspace Settings → Provisioning. On first visit, the status shows Not configured.
Click Enable SCIM to generate a SCIM token. It's shown in plain text exactly once — copy it immediately. Once you leave the screen (or confirm you've saved it), it's masked permanently and can't be viewed again.
Note your SCIM Base URL:
https://api.verybusy.io/scim/v2— this is always visible and copyable, unlike the token.
Keep the token safe. Anyone with this token can manage your workspace members. If it's ever compromised, click Rotate on the same page to generate a new one — you'll then need to update your IdP with it before the old token is revoked.
Step 2 — Connect your identity provider
From here, the pattern is the same for every IdP: create an application for VeryBusy, paste in the SCIM Base URL and token from Step 1, test the connection, enable the provisioning actions you want, then assign the users or groups to sync. The exact screens differ per provider, so follow the section that matches yours:
Okta — see "Configure Okta" below
Microsoft Entra ID — see "Configure Microsoft Entra ID" below
Configure Okta
In the Okta Admin Console, go to Applications → Browse App Catalog, search for "SCIM 2.0 Test App (Header Auth)", and select Add Integration. Name it "VeryBusy".
Complete the wizard with the defaults — the SAML/SWA sign-on settings aren't used for provisioning and can be left empty.
Open the app's Provisioning tab → Configure API Integration → check Enable API integration, then fill in:
SCIM 2.0 Base Url:
https://api.verybusy.io/scim/v2Unique identifier field for users:
userNameHTTP Header → Authorization (Bearer): paste your VeryBusy SCIM token
Click Test API Credentials — you should see a success message — then Save.
Still in Provisioning → To App, click Edit and enable:
✅ Create Users
✅ Update User Attributes
✅ Deactivate Users
Go to the Assignments tab and assign the users or groups you want to provision.
⚠️ Okta suspend is not supported. Suspending a user in Okta doesn't send any SCIM request, so they'd keep their VeryBusy access. To cut access, use Deactivate or unassign the user from the app — both correctly notify VeryBusy.
Configure Microsoft Entra ID
In the Microsoft Entra admin center, go to Entra ID → Enterprise apps → + New application → + Create your own application.
Name it "VeryBusy", choose "Integrate any other application you don't find in the gallery (Non-gallery)", and select Add.
In the app, open Provisioning and create a new configuration (classic UI: Get started → set Provisioning Mode to Automatic).
Fill in the credentials:
Tenant URL:
https://api.verybusy.io/scim/v2Secret Token: paste your VeryBusy SCIM token
Click Test Connection, then save/create the configuration.
Under Users and groups, assign the users or groups to sync. With the default scope, nothing syncs until someone is assigned. Note: nested groups aren't resolved — only direct members of an assigned group sync.
Click Start provisioning.
Good to know:
Entra syncs in cycles of roughly 40 minutes — changes aren't instant. To push a single user immediately, use Provision on demand.
Disabling or deleting a user in Entra both result in the same thing in VeryBusy: the member is deactivated.
Provisioning activity and errors are visible under Enterprise apps → Provisioning logs in Entra, and in VeryBusy's own Sync History (see below).
What you'll see in VeryBusy
The Provisioning screen (Workspace Settings → Provisioning) shows one of these statuses at all times:
Status | Meaning |
Not configured | SCIM has never been enabled for this workspace. No token exists yet. |
Active | SCIM is on. The SCIM Base URL and a masked token are shown, with a "Last sync" line: a timestamp if the last event succeeded, "Never synced yet" if the token exists but your IdP hasn't called it, or a warning if the last sync had errors. |
Disabled | The owner turned SCIM off. Your token is preserved but your IdP can no longer authenticate. Click "Re-enable SCIM" to resume without generating a new token. |
From the Active state, the owner can Rotate the token (generates a new one — you'll need to update your IdP before the old one stops working) or Revoke it (removes it entirely, IdP loses access immediately).
Sync History — reading your provisioning log
Below the token settings, Sync History logs every provisioning event your IdP triggers — useful for troubleshooting and for your own audit/compliance records. Each row shows a status icon, the action, the user's email, and a timestamp (plus a reason, for failures):
Icon | Action | What it means |
✓ | provisioned | A new user was created and added to the workspace, or an existing user was linked in. |
✓ | updated | A user's name or email was changed from the IdP. The changed field is shown as the detail. |
✓ | deactivated | A user was deactivated or unassigned in the IdP and lost access in VeryBusy. |
✓ | reactivated | A previously deactivated user was reassigned/reactivated in the IdP and regained access. |
✕ | provision_failed | Creating/linking the user failed — commonly because the workspace hit its seat limit. The reason is shown as the detail. |
✕ | update_failed | An update from the IdP couldn't be applied. |
✕ | deactivation_failed | A deactivation request from the IdP couldn't be applied. |
Events load 20 at a time, most recent first, with a "Load more" option. If SCIM is active but nothing has synced yet, you'll see: "No sync events yet. Once your IdP starts syncing, events will appear here."
Deactivation and removal — what happens when someone leaves
This is the most important behavior to understand, and it's the same regardless of your IdP:
When your IdP deactivates a user:
They immediately lose access to the workspace and all its projects.
They remain in your workspace members list, marked inactive, and still occupy a seat.
All their data stays intact — projects they own, comments, project memberships.
If they're reactivated from your IdP, everything is restored exactly as it was.
If they're not coming back, remove them manually from VeryBusy: go to your workspace Members list and remove the inactive member. This frees up their seat and automatically transfers any projects they owned to the workspace owner, so no work is lost — similar in spirit to (but automatic, unlike) a manual project ownership transfer.
Why isn't removal automatic? Deactivations from an IdP are sometimes temporary or accidental (e.g. a group rule change). Keeping the member inactive makes deactivation fully reversible; removal — which transfers project ownership — stays a deliberate, manual step.
Limitations
Groups: SCIM group provisioning is not supported — assign users individually in your IdP.
Okta suspend: not supported — use Deactivate instead.
Passwords: not synced. SCIM-provisioned users set their password via the invitation/reset email.
Roles: provisioned users join as regular workspace members. The workspace owner adjusts workspace roles, and project-level roles (see what permissions each project role has), manually in VeryBusy afterward.
One token per workspace: generating a new token invalidates the previous one.
Troubleshooting
Issue | Resolution |
"Test API Credentials" / "Test Connection" fails | Check that the base URL is exactly |
User assignment fails with a permissions error (403) | The workspace has reached its subscription's member limit. Free a seat (remove an inactive member) or add seats to your plan. Check Sync History for a "provision_failed — Seat limit reached" entry. |
Deactivated user still appears in the members list | This is expected — see "Deactivation and removal" above. Remove them manually to free the seat. |
A suspended Okta user still has access | Okta doesn't send SCIM requests on suspend. Deactivate or unassign the user instead. |
Entra: changes take a long time to appear | Entra syncs roughly every 40 minutes. Use "Provision on demand" to push a user immediately. If the connection is broken (e.g. bad token), fix the credentials and restart provisioning. |
Not sure who has access to manage this | Only the workspace owner can configure SCIM. See "Who can access SCIM Provisioning" above for how to request access for another admin. |
Still stuck? Reach out to support@verybusy.io and we'll help you get connected.