Keep staff accounts in step with SCIM
Let your identity provider create, change and switch off your staff's Taktyl accounts.
SCIM lets your identity provider, such as Microsoft Entra ID or Okta, create your staff's Taktyl accounts before they first sign in, keep their names and addresses up to date, and switch them off when they leave. It is on every plan.
Assign only your staff groups
Assign only your staff groups to Taktyl in your provider. Never assign all users or everyone: SCIM cannot tell a student it has never seen from staff, so it would make them staff, and each one would take a seat.
Make a token
- Go to the Single sign-on screen and find Provisioning (SCIM).
- Press Make a token, then copy it straight away. Taktyl shows it only once.
- In your provider, paste the SCIM base address as the Tenant URL or Base URL, and the token as the Secret Token or Bearer token.
Make a new token replaces it: the old one stops working at once, so paste the new one into your provider straight away. Remove the token stops provisioning; the people it provisioned keep their accounts.
What it does
- Somebody new joins as an Organisation Member. You give any other role from Members. SCIM never changes a role.
- Their email domain must be approved for your organisation. An address on another domain is refused.
- Switching somebody off in your provider suspends them here. Their account and their work stay. Switching them on again lifts only the suspension SCIM made: if you suspended somebody yourself, they stay suspended.
- Deleting somebody in your provider switches them off and forgets the link. Nothing is deleted.
- SCIM never switches off your last organisation admin who can still sign in. Make somebody else an organisation admin first.
- Students are never changed by SCIM.
- If the plan has no free places for new staff, the person is refused until you free one.
Two accounts for one person
When your provider sends an address that already belongs to a second Taktyl account, the two cannot be joined automatically. The screen lists them under Provisioning. Merge them on Members: see Merge two accounts of one person.