SCIM user management for your organization

After you've set up SAML authentication for your organization, you can generate a SCIM API token.

Features

Providing the SCIM API token to your identity service provider allows you to take the following actions through your identity provider:

  • Create users
  • Deactivate users

Requirements

Before you set up SCIM user management, you need to verify your domain and create a SAML configuration. You can only manage users who are associated with a domain that you've verified.

Configure SCIM user management

  1. In your Shopify organization admin, go to Users > Security.
  2. In the SCIM integration section, click Generate API token.
  3. Click Copy to copy the generated token to your clipboard.
  4. Provide the token to your identity service provider. The procedure for adding the token depends on which identity service provider you use.


After your API token has been added to your identity service provider, you can add or remove users through that service. Depending on the status of that user within Shopify and your identity service provider, this can change how they log in to Shopify.

Effects of creating a user in an identity provider
User status Effect within Shopify
User already exists in your organization If you add a user in your identity service provider, then the user is required to log in using SAML authentication if all the following are true:

  • the user already exists in Shopify
  • the user already exists in your organization
  • you use Specific users enforcement
The effect of removing a user's access through your identity provider depends on their user status. If you remove an active user's access to Shopify using your identity service provider, then they are suspended in your organization. If you permanently delete a user using your identity service provider, then they might be deleted from your organization, depending on your identity provider setup.
User exists in Shopify, but not your organization If you add a user in your identity service provider, then the user is added to your organization and required to log in using SAML authentication if all the following are true:

  • the user already exists in Shopify
  • the user does not exist in your specific organization
  • you use Required or Specific users enforcement
User does not exist in Shopify If you add a user in your identity service provider, then the user is added to your organization and required to log in using SAML authentication if all the following are true:

  • the user does not exist in Shopify
  • you use Required or Specific users enforcement
When the user signs in to the Shopify organization admin for the first time, then that user must do so through the identity provider, not through the Shopify login page.

After adding the API token, when you add a new user who did not previously exist in Shopify either through your identity provider or the organization admin, your new user is set to pending status. If your user is required to log in using SAML, then they will remain in pending status until they log in using your identity provider.

Removing SCIM integration

If you no longer require a SCIM integration, then you can remove it. This action can't be undone. If you need to reactivate your integration, then you need to generate a new API token.

Steps:

  1. In your Shopify organization admin, go to Users > Security.
  2. In the SCIM integration section, click ... beside the API token.
  3. Click Delete token.

Restrictions

Store owners and organization owners can't be removed through an identity service provider. Both types of ownership must be transferred before the user can be removed. If you need to change the store owner, then you can do so from your Shopify admin. If you need to change the organization owner, then contact Shopify Plus support.

Ready to start selling with Shopify?

Try it free