System for Cross-domain Identity Management (SCIM) is an open standard for automating the exchange of user identity information between identity domains or IT systems. You can configure Dynatrace SaaS to be provided with user identity information automatically from your organization's identity provider (IdP) through SCIM.
SCIM in Account ManagementSCIM are managed by SCIM only and cannot be removed or modified through Account ManagementUsers in SCIM groups are not listed in the web UI for sharing a document (dashboard or notebook) to specific users or groups unless you add those users to local Dynatrace groups.
Dynatrace supports SCIM 2.0 and GET, POST, PATCH, PUT, and DELETE operations for both User and Group resources.
For authentication, SCIM requires Bearer token in Authorization header.
SCIM is configured for the account and domain scopes. At least one domain ownership verification is required for the account.
Only users whose email domains have been verified for ownership can be synchronized with Dynatrace via SCIM.
Required and supported SCIM attributes:
| SCIM Attribute | Type |
|---|---|
userName | email format |
name.givenName | string |
name.familyName | string |
active | boolean |
Dynatrace supports changing a user's email/login (the SCIM userName) through SCIM. For details, see Is a change of email address supported?.
Before you can proceed with SCIM configuration, you need to prove ownership of the domain. Verification is based on a DNS TXT Record check.
For the account, it is sufficient to verify the domain once. If a domain has been verified for SAML, it will be valid for SCIM as well.
To verify ownership of a domain
mycompanyname.com) for which you want to set up SCIM and select Add to add it to the Pending domains table.
If users in your organization use more than one domain to sign in (for example, @mycompanyname.com and @uk.mycompanyname.com), you can add additional domains in additional rows and start verifying them all in parallel. Enter each domain in a different row.
It typically takes a few minutes for a record to propagate through the DNS system and the value to become available for Dynatrace to verify. In some cases, it may take up to 24 hours.
Use this procedure to get the Dynatrace SCIM Base URL for your account and create a secret token.
The token is revealed only once during generation time. Copy and paste it into a secure location. If you lose it, you have to generate a new one and replace it in your application.
Go to Account Management > Identity & access management > SCIM configuration.
In the Generate new token section, optionally enter a token Description (or you can add a description for the token later).
Select Generate token
Next to Token value, select Copy to copy the token to your clipboard, and then paste it into a secure location for later use.
Dynatrace SCIM supports Bearer Token Authentication only. Example:
| Header | Value |
|---|---|
Authorization | Bearer dt0s01.XFNYASDX.XFJWNDTUXJ6PKHEHDDVKXV2K73ZDGWUFS6GKHGAFKE2DUG3JYCFXJUAGLXTN6ENX |
The SCIM endpoint required for SCIM configuration in your application is added to the List of tokens.
To continue integrating Dynatrace SCIM with your IdP, select the procedure appropriate for your IdP:
Yes. In Dynatrace, a user's email address is also their login (the SCIM userName), and the two always change together. When you change a user's email address in your IdP, SCIM applies the change in Dynatrace and the user keeps their group memberships and permissions:
jane@example.com becomes jane_archived@example.com), so the new address becomes available for the existing user.Both cases are handled automatically, and the user's identity, groups, and permissions are preserved.
If the new email address is already used by another existing user account that's more than a day old (one that a person actively signs in with), applying the change requires a user account reassignment, which moves your IdP's link onto that existing account. This is disabled by default because it hands control of an existing Dynatrace user to your IdP: from that point the IdP can change, disable, or delete that user, and the previously synchronized account is detached and loses access. To enable it for your account, contact Dynatrace Support. For what this involves, see the next FAQ entry.
A user account reassignment applies only when the new email/login is already used by an existing Dynatrace user account that's more than a day old. It's disabled by default; contact Dynatrace Support to enable it for your account.
When user account reassignment is enabled and this case occurs:
Because the migrated group memberships reflect the state at the time of the change, they can be temporarily out of date until your IdP completes a full provisioning run, which reconciles group membership to the current state in your IdP.
Detaching the previously synchronized user account has important consequences:
The detached user account is not deleted. If it needs to be restored in an emergency, it can be reattached to the Dynatrace account, but this requires involving Dynatrace Support.
You can generate up to 10 SCIM authentication tokens. For security reasons, we strongly recommend that you delete all unused tokens.
Yes, you can provision as many users from different email domains as you need, as long as all of their domains have been verified. You can verify multiple domains for a single account.
No, some IdPs, like Azure AD, allow multiple groups with the same name in a single account. For Dynatrace SSO, however, each group name in an account must be unique.
description during provisioning?No, we're limited by the SCIM protocol specification, so additional fields, such as description, can't be set during provisioning.
Yes, you can restart SCIM synchronization. To do this, go to the SCIM application's Overview tab and select Restart provisioning.