Dynatrace enterprise identity management integrates with your identity provider (IdP) to streamline authentication, provisioning, and user lifecycle management. Dynatrace supports three identity management approaches:
SAML: delegated authentication and single sign-on (SSO) through your IdP.
SCIM: automated provisioning and deprovisioning of users and groups from your IdP.
Dynatrace API integration: custom user and group provisioning workflows.
Who is this for?
This tutorial is for Dynatrace account administrators who need to manage enterprise identity using SAML, SCIM, and API integration.
What will you learn?
In this article, you'll learn how to:
Decide your enterprise identity management approach.
Configure SAML for your identity management.
Configure SAML and SCIM together for your identity management.
Configure SAML and API integration for your identity management.
Configure SCIM-only approach for your identity management.
A Dynatrace account with administrative privileges.
Administrative access to your identity provider (IdP).
Access to your DNS settings for domain ownership verification.
Key terms
SSO (Single sign-on)
Users authenticate through one trusted identity provider and access Dynatrace without separate credentials.
IdP (Identity provider)
Your organization's authentication system that manages user identities and credentials. Dynatrace integrates with your IdP to authenticate users and provision access.
SAML (Security Assertion Markup Language)
Security Assertion Markup Language. Protocol for delegating authentication to your IdP. Dynatrace uses SAML federation so users sign in with corporate credentials without separate Dynatrace passwords.
SCIM (System for Cross-domain Identity Management)
System for Cross-domain Identity Management. Standard protocol for automated synchronization of users and groups from your IdP to Dynatrace.
Just-in-time (JIT) provisioning
Automatically creates a user account in Dynatrace on first login through SAML.
Decide your enterprise IAM approach
Connecting your identity provider (IdP) to Dynatrace provides a single identity source across your organization. Dynatrace supports three components:
SAML for authentication and SSO
SCIM for automated user and group provisioning
Dynatrace APIs for custom provisioning workflows
You can use these components individually or together. Use this section to identify the best option for your organization before configuring your integration.
Why use identity federation?
Enterprise identity federation helps you:
Use single sign-on: SAML lets users authenticate with corporate credentials instead of Dynatrace credentials.
Centralize identity governance: SAML manages authentication. SCIM automates provisioning and deprovisioning. Dynatrace APIs support custom workflows.
Automate user lifecycle management: SCIM manages and syncs provisioning, deprovisioning, and group membership. Dynatrace APIs enable custom logic and approvals.
Strengthen security and compliance: SAML enforces consistent authentication. SCIM keeps groups aligned. Dynatrace APIs support centralized permission and group management.
How to select an identity federation?
Use the following table to select the best approach for your organization.
Approach
When to use
Why
Use SAML only
You already have SSO in your IdP
You don’t need automated provisioning
You want fast deployment with minimal configuration for small or medium user bases
SAML delegates authentication to your IdP. No separate Dynatrace credentials needed.
Users are created on first login (just-in-time provisioning)
No manual provisioning or user management needed in Dynatrace
No SCIM or provisioning API required
Use SAML and SCIM together
Your IdP supports SCIM provisioning (for example, Azure AD or Okta)
You need automated onboarding, group and role changes, and offboarding
You need IdP-driven group synchronization
This is the recommended enterprise approach for most organizations.
SAML handles authentication. SCIM syncs users and groups from your IdP in one direction.
Group membership remains consistent across IdP and Dynatrace
Users are removed immediately when deprovisioned in the IdP
Use SAML and API together
You need custom validations, approvals, or conditional provisioning
You need fine-grained control over group permissions that SCIM doesn't cover
Your IdP doesn't support the SCIM flow you need
SAML handles authentication, and Dynatrace APIs handle provisioning
APIs support custom group creation and permission logic
SCIM only
You need provisioning automation before SAML federation is in place
Authentication is managed outside SAML (for example, legacy SSO)
You’re running a phased migration with partial identity integration
You keep a legacy SSO or alternate sign-in model but still need automated lifecycle management
Supports a provisioning-first approach during phased migration
SCIM syncs users and groups from your IdP to Dynatrace (one-way, verified domains only)
Group permissions still assigned manually in Dynatrace
Steps to configure your enterprise identity management
Choose the approach that fits your organization's needs and existing infrastructure.
Option 1: Configure SAML-only identity management
Use SAML‑only when you need delegated authentication and SSO without automated provisioning. Dynatrace authenticates through your IdP and creates users at first sign‑in through just-in-time provisioning.
Steps to configure SAML-only identity management:
Create a fallback user account: Create a non-federated account for administrative access if configuration issues occur.
Verify your domain ownership: Prove ownership through DNS to activate SAML configuration.
Configure SAML: Register your IdP metadata with Dynatrace.
Test your configuration: Validate the setup with a trial sign-in.
Group membership must be assigned manually; SAML doesn't sync groups automatically.
User deprovisioning is manual. Deactivate users in Dynatrace separately.
SAML maps users to Dynatrace groups at login based on the IdP configuration. Assignments can change each session.
Learn more
To understand SAML federation types (account, environment, or global), see Federation types.
To explore federation use cases and implementation patterns, see Federation use cases.
To learn more about assigning permissions after users are created, see SAML authorization.
Option 2: Configure SAML and SCIM integration
Use SAML and SCIM together when you need delegated authentication and automated lifecycle management. SAML manages sign‑in, and SCIM syncs users and groups so provisioning, updates, and deprovisioning happen automatically.
Recommended This is the recommended enterprise approach for most organizations.
Use SAML and API integration when you need custom provisioning logic beyond standard SCIM capabilities. Use this approach when your IdP doesn't support SCIM, when you already have identity orchestration pipelines, or when you need conditional provisioning and approval workflows.
Steps to integrate SAML with custom API-based provisioning:
Configure SAML for authentication: Configure SAML to handle user sign-in through your identity provider (IdP) and assign users to Dynatrace user groups at login.
Configure your identity source: Identify and configure your source of truth for identity lifecycle events. This could be your IdP event stream, an identity orchestration platform, or a custom user management system.
Prepare API authentication: Create an OAuth 2.0 client in Dynatrace and obtain a bearer token with the required account management API scopes.
Build an automation pipeline: Create automation that listens for identity lifecycle events and calls the Dynatrace account management API to manage users and user groups in your Dynatrace account.
Test and validate the workflow: Add error handling, retries, logging, and audit trails. Then validate user onboarding, group membership changes, and user deprovisioning scenarios end to end.
Setup considerations
Provisioning updates apply only when your automation pipeline runs. Dynatrace doesn't sync in the background and changes in your IdP aren't reflected in real time.
You own pipeline monitoring, error handling, and reliability. This creates more operational overhead than SCIM.
Use the Account Management API to manage Dynatrace user groups programmatically.
Use SCIM-only when you need automated provisioning without SAML authentication. Use this during phased migrations or when a legacy system still manages authentication. SCIM synchronizes users and groups from your IdP to Dynatrace, while sign-in is managed separately.
Steps to configure SCIM provisioning without SAML:
Configure sign-in separately: Configure your sign-in method outside SAML configuration, such as username and password, legacy SSO, or another federation method.
Assign permissions to groups: Assign account permissions to SCIM-managed groups in Dynatrace.
You now know when to use and how to implement SAML-only, SAML with SCIM, SAML with APIs, or SCIM-only approaches. Choose the model that matches your current identity architecture and rollout plan, then follow the linked setup guides for implementation details.