When a company is founded there might be a single person, or maybe a handful of people who need setting up with access to platforms such as AzureAD, GitHub, Datadog, AWS, etc. It's not a big deal to provision these accounts manually on an adhoc basis in a situation where there isn't a large number of users to manage.
Overtime, if the business is successful, the company along with the number of people it employs will inevitably grow. The attrition rate will likely increase too. And as a result, that simple process of managing identities becomes a massive pain in the arse.
This is the problem SCIM exists to try and solve. It's a set of protocols, which form a standard, for managing users, groups, and roles across the various platforms you use as a business. It's a way of ensuring consistency across applications, facilitates the automation of compliance, and supports an efficient Joiners, Movers, Leavers (JML) process.
Although it's easy to ignore in the beginning, it's also easier to configure SCIM for your platforms from the start than to roll out retrospectively. That being said you don't want to spend time over optimising until you have proven the viability of your business, but once you have it's beneficial to automate your JML processes as much as possible. You want to avoid a situation where ex-employees still have access to enterprise applications after they have left the business, due to a manual process being accidentally missed, and SCIM helps to ensure this won't happen.
In an ideal scenario your HR platform would control the JML process, by utilising SCIM within your identity provider, which in turn would utilise SCIM within the various enterprise applications and platforms you use across the business.
This would mean when someone new joins the business, and their role is mapped to the correct groups, their identity is provisioned along with accounts for all the platforms they need access to, all scoped correctly with the appropriate level of permissions.
When that employee is promoted, or changes roles within the business, those changes are automatically reflected across their accounts. And, if they decide it's time to move on to pastures new, they're automatically removed from all business accounts when updating the user in the HR platform.
If you are looking to implement SCIM for your own platform, so that you can integrate with other services, it's intentionally simple to implement. SCIM is essentially a RESTful API with standardised endpoints for /Users and /Groups. Microsoft provide a robust tutorial, which is worth checking out, to help you get started, "Develop and plan provisioning for a SCIM endpoint in Azure Active Directory".
At the time of writing the website for SCIM is domain parked on GoDaddy, and no longer appears to be in service; however, here's the link to check it out in case it comes back online at a later date: simplecloud.info.
Update: scim.cloud
