SCIM Connection Guide

📘
Beta — Directory Sync (SCIM) is currently in beta and available to net-new enterprise customers only. Existing customers interested in connecting SCIM should contact their Customer Success representative; a migration path is being developed for general availability.

Overview

Section Coach (formerly, "ProfAI") supports SCIM 2.0-based Directory Sync for enterprise clients. Once enabled, employees provisioned in your identity provider (IdP) are automatically created in Section Coach, and deactivations in your IdP automatically revoke access — eliminating the need for CSV imports or manual user management.

SCIM is built on top of your existing SSO connection. Completing SSO setup is a prerequisite to enabling SCIM — see the SSO Connection Guide before starting the process below.

Please reach out to your Customer Success representative if you have questions or difficulty with the process below.

How It Works

Once Directory Sync is established, your IdP pushes user changes to Section using the SCIM 2.0 standard:

Create — When IT assigns a new employee to Section in your IdP, that user is provisioned in Section Coach and can sign in immediately.
Update — When an employee's name or profile attributes change in the IdP, the change flows through to Section automatically.
Deactivate — When IT removes or deactivates an employee in the IdP, that user is signed out of Section and blocked from signing back in.

The mechanics: your IdP sends SCIM 2.0 events to Clerk (Section's authentication provider), Clerk applies the change, and Section's user list stays continuously in sync with your IdP.

Technical note: in practice, especially at large organizations, there's at least one hop between "new hire" and "enabled for Section." IT staff assign employees to IdP groups within their org, and then assign those groups to Section. This is the same mechanic as SSO.

Supported Identity Providers

The Section Coach SCIM beta supports:

Okta
Microsoft Entra ID (formerly Azure AD)

If your organization uses a different IdP, contact your Customer Success representative.

Setup Sequence

Step 1 — Client: Complete SSO Setup

If your organization has not yet completed SSO with Section, follow the SSO Connection Guide first. SCIM cannot be enabled on a connection without an established SSO link.

Step 2 — Section: Provide SCIM Endpoint and Bearer Token

Once your SSO connection is active, Section will enable Directory Sync on your connection and send you two values:

Value	Purpose
Endpoint URL	The SCIM 2.0 endpoint your IdP will push user changes to.
Bearer token	The API credential your IdP will use to authenticate to that endpoint.

Treat the Bearer token as a secret — store it in your IdP's credential field, not in plaintext documentation or shared channels.

Step 3 — Client: Configure Your IdP

Configure your IdP to push users to the endpoint provided by Section.

In the Okta admin dashboard, open your Section enterprise app and go to the Provisioning tab.
2. Select Configure API Integration and enable Enable API integration.
3. Paste the Endpoint URL from Section into the SCIM connector base URL field.
4. Set Unique identifier field for users to userName.
5. Paste the Bearer token from Section into the API Token field.
6. Click Test API Credentials to confirm the connection, then click Save.
7. Under To App, enable: Create Users, Update User Attributes, and Deactivate Users. Click Save.
8. Under Attribute Mappings, confirm email (user.email) is mapped. Even if userName is the user's email, a separate mapping to email is required.
9. Assign the users or groups that should have access to Section.

Step 4 — Section: Verify Provisioning

Once your IdP completes its first sync, Section will confirm that users have been provisioned successfully. You can verify by signing in as one of the newly provisioned users.

Synced User Attributes

The following attributes are synced from your IdP to Section. Once SCIM is enabled, these fields are managed exclusively by the IdP and become read-only in Section — changes must be made in your IdP and will flow through on the next sync.

Section field	SCIM attribute
User ID	`id`
Email address	`email.value`
First name	`name.givenName`
Last name	`name.familyName`
Active state	`active`

Section does not receive payroll data, compensation, social security numbers, or any sensitive fields beyond those listed above.

FAQs

Do I need SSO before SCIM?

Yes. SCIM is configured on top of an existing SSO connection. See the SSO Connection Guide.

What happens when an employee is deactivated in our IdP?

The user is signed out of Section, blocked from signing back in, and the seat is reclaimed immediately so it can be reassigned to a new user. The user's history is preserved internally but they no longer appear in customer-facing reports.

What happens when a deactivated employee is re-added in our IdP later?

The user is automatically reactivated and restored to their prior state — organization, role, and progress are preserved. No admin action is required.

What happens if we provision more users than our contracted seat count?

You will not experience a hard block at the IdP layer while this is resolved. Your Customer Success representative will reach out.

How are seat counts displayed?

Seat usage ("X of Y seats used") is visible in the Section HQ admin dashboard both before and after SCIM is connected. Once SCIM is connected, the count reflects users provisioned by your IdP in near real time.

How are users who were provisioned but never logged in counted in reporting?

These users are excluded from engagement and activation metrics until their first sign-in, so unused provisioned accounts don't artificially depress your reported engagement rate.

Will SCIM-provisioned users be reported differently from users we added manually?

No. Reports do not split users by provisioning method. All users — manually added, self-enrolled, or SCIM-provisioned — appear in unified reporting.

What about users in Section who aren't in our IdP (e.g., contractors)?

During beta, SCIM is available to net-new customers, so this case does not apply. At general availability, accounts that aren't in your IdP at migration time will remain in Section as manually-managed accounts; SCIM will not touch them.

How are SCIM errors surfaced if something fails after setup?

SCIM errors (malformed requests, failed provisioning events, etc.) are surfaced in an error log in the Section HQ admin dashboard. For broader or persistent issues, your Customer Success representative will be alerted and reach out.

Which IdP does Section use under the hood?

Clerk. Section's SCIM endpoint is provided by Clerk, which acts as the SCIM service provider on Section's behalf.

Can I disconnect SCIM?

Yes. To protect against accidental loss of provisioning, SCIM disconnection is handled through your Customer Success representative rather than self-serve. Contact them and Section will disable the SCIM connection; SSO will continue to work unaffected.