Gong Scim
You set up gong scim by linking your identity provider to the Gong app. This link creates, updates, and turns off user accounts based on your team groups. Most IT teams map wide directory groups straight to standard app roles. When those groups grant broad rights, users get more data and settings than needed. How gong scim works with your identity provider SCIM is an open standard that moves user data between two systems. Your identity provider acts as the main source of truth for your compan
Scim: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up gong scim by linking your identity provider to the Gong app. This link creates, updates, and turns off user accounts based on your team groups. Most IT teams map wide directory groups straight to standard app roles. When those groups grant broad rights, users get more data and settings than needed.
How gong scim works with your identity provider
SCIM is an open standard that moves user data between two systems. Your identity provider acts as the main source of truth for your company. When HR adds a new hire, the provider sends a profile to Gong. The app reads this message and builds the right user account right away.
Teams also use group rules to set seats and manager chains during sync. You link a group in your directory to a specific profile inside the app. When a person moves to a new team, the provider sends an update. The target app then swaps their role and moves them under the new manager.
When someone leaves the company, you turn off their main login profile. The provider pushes a quick signal that locks their seat in the revenue app. This stops former staff from reading call notes or sales deals after they leave. It also frees up paid seats without an admin doing manual work.
What user sync solves and what it leaves open
Automated user sync fixes the problem of slow manual account setup and removal. Admins no longer spend hours making profiles or hunting down stale logins. Your security team knows that active app accounts match your main company roster. This keeps your user list clean for audits and cuts down on human error.
Still, account sync only controls who has a seat in the web app. It does not control how engineers or scripts read synced call data in databases. Many teams export revenue data into data warehouses or internal tools for custom work. Once an engineer logs into those backend systems, directory sync stops helping.
Scim: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Directory groups assign coarse roles that stay on all day and night. They cannot inspect a single query or block a risky command in flight. If an engineer runs a broad read query, they pull raw customer phone numbers. Masking rules can rewrite emails, phone numbers, and card numbers in query results. Account sync alone cannot apply field masking or ask for peer review per command.
How to tighten role rules before and after sync
Start by breaking big department groups into smaller task groups in your identity provider. Give most staff a basic viewer profile by default during the initial sync. Put admin rights in a separate group that stays empty most of the time. Review these group links every quarter to catch old rules that crept in.
Next, look at the backend databases and scripts that hold exported revenue records. Treat live database sessions and API tools as a separate control point from SCIM. Require engineers to get quick manager approval before they run changes on production tables. Log every statement and mask sensitive fields like national IDs in the output.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does Gong SCIM replace single sign-on?
No, SCIM and single sign-on work together to handle different parts of login. SCIM builds and removes the user account, while single sign-on checks the login password.
What happens to recorded calls when SCIM turns off a user?
Turning off a user through SCIM locks their login seat right away. Their past recorded calls and deal notes stay in the system for the team.
Can SCIM control database queries on exported Gong data?
No, SCIM only manages user accounts and high-level roles inside the main app. It cannot inspect or mask live queries that engineers run on your backend databases.