Automate user management with user provisioning

User provisioning connects your identity provider (IdP) to Mitti so that user accounts are created, updated, and deactivated automatically. This page explains the two supported methods, SCIM and JIT, and covers requirements, setup, seat type configuration, and what gets synced.

🚧

The Microsoft Gallery app currently doesn't support SCIM. If your organization uses Azure Active Directory for single sign-on and you want to set up SCIM user provisioning, use a non-Gallery app for Active Directory instead.

Provisioning methods

Mitti supports two methods of user provisioning: System for Cross-domain Identity Management (SCIM) and Just-in-Time (JIT).

Use SCIM if you need to manage the full user lifecycle, including deactivation, removal, and group membership, directly from your IdP. Use JIT if your organization only needs accounts created at login and does not require deactivation or group sync.

Seat availability and billing

When your seat limit is reached during provisioning, Mitti either purchases additional seats automatically or fails to provision the user, depending on whether automatic seat purchasing is turned on for your organization.

If it's on, users are provisioned with the correct seat type, your billing admin receives a summary email, and your next invoice includes a prorated charge. However, when it is off, provisioning fails for any user beyond your seat limit until you purchase more seats or turn the setting back on. Confirm this setting with your billing admin before relying on provisioning to add users at scale.

🪄

Monitor your seat allocation in the Mitti web app, and contact your customer success manager with any questions.

Set up SCIM user provisioning

Mitti supports all identity providers for SCIM provisioning. Setup steps vary depending on your chosen identity provider.

Requirements

• Mitti Enterprise Plan
• Web app
• Single sign-on with Mitti
• Service user API token
• "Platform management: Organization" permission

Use the following guides for the most common providers:

• Microsoft Azure Active Directory
• Okta
• OneLogin
• PingFederate

During setup, your identity provider will ask for an API token and the following connection details:

• Connector URL: https://api.mitti.com/accounts/scim/v2
• Unique Identifier: Each user's email address.
• Authorization: HTTP Header (Bearer token)

Configure seat type mapping

Newly provisioned users are assigned a full seat by default. You can change this by configuring seat type mapping in your identity provider before provisioning runs.

1. In your identity provider, open the attribute mapping settings for your Mitti application.

2. Map the seat type attribute using the notation for your identity provider:

   • Microsoft Entra ID (Azure AD):

     • External namespace: seat_type
     • External namespace: urn:ietf:params:scim:schemas:extension:mitti:2.0:seat_type

   • Okta:

     • External name: seat_type
     • External namespace: urn:ietf:params:scim:schemas:extension:mitti:2.0

3. Set the value to one of the following options:

   • full : full seat (default if no value is set)
   • lite : lite seat
   • free : guest seat

4. Save your mapping and test provisioning with a single user before turning on auto-sync.

📘

Our customer support team can only provide limited help for single sign-on and user provisioning. If your organization is on the Enterprise Plan, please contact your customer success manager for assistance.

Set up JIT user provisioning

JIT provisioning creates a user's Mitti account the first time they log in through your identity provider, then updates their details on each successful login. Unlike SCIM, you turn JIT on in the Mitti web app, and you verify each email domain you want to provision users for.

All users provisioned through JIT are assigned a full seat. Accounts are only created at login, so you have to deactivate users manually in the web app.

Requirements

• Mitti Premium Plan or Enterprise Plan
• Web app
• Single sign-on with Mitti
• "Platform management: Organization" permission

1. Log in to the web app.
2. Click your organization name on the lower-left corner of the page and select Organization settings.
3. Select Security on the top of the page.
4. Click Edit in the "Single sign-on (SSO)" box.
5. Turn "Just-in-Time provisioning (JIT)" on.
   
6. Click Save changes.
7. For each email domain, click Verify and follow the instructions in the pop-up window to update your DNS records. Then, click Verify.

📘

If your organization uses Azure Active Directory for single sign-on, and you want to set up JIT user provisioning, refer to Microsoft's support article for instructions.

Synced data

The following data is synced with your identity provider for each user:

• Name
• Email address
• Group names
• Group members (for each group)

SCIM provisioning also supports deactivating and removing users or groups. JIT only supports creating and updating users.

Frequently asked questions