License Reclamation Scim
You can run license reclamation scim by linking your identity provider to your apps. When an admin removes a user from a group, SCIM revokes the seat. Teams often map whole departments to app groups to save time during onboarding. This broad setup gives out too many seats and leaves wide permissions open. How license reclamation scim works in practice SCIM is an open standard that syncs user data between systems. Your identity provider holds the master list of users and groups. You link the p
Reclamation Scim: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You can run license reclamation scim by linking your identity provider to your apps. When an admin removes a user from a group, SCIM revokes the seat. Teams often map whole departments to app groups to save time during onboarding. This broad setup gives out too many seats and leaves wide permissions open.
How license reclamation scim works in practice
SCIM is an open standard that syncs user data between systems. Your identity provider holds the master list of users and groups. You link the provider to your target app using a secret token. Then you map specific identity groups to roles inside the downstream app.
To reclaim seats, you track when users last logged into the app. When a seat sits idle for thirty days, a workflow runs. That script removes the idle user from the assigned group in your directory. Next, the provider sends a web request to the app on a schedule.
The app reads this update and marks the user account as inactive. Once the account is inactive, the app frees up that paid license. You can now give that seat to another person on the team. If the first user needs the tool again, they request group membership.
Why group sync works for SaaS
This setup handles user lifecycle changes across dozens of cloud tools at once. IT teams do not have to log into each app to delete users. When someone leaves the company, one change in the directory disables their accounts. It also stops teams from paying for software seats that nobody uses.
Role mapping works well when a user needs the same role every day. For example, a designer needs their design app from morning until night. Taking away the seat after weeks of no activity makes sense here. The sync loop runs in the background and keeps seat counts clean.
Reclamation Scim: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Where SCIM falls short for databases and production systems
SCIM only decides who has an active account in a target system. It does not check what a user does after they log in. For databases, servers, and cloud consoles, standing accounts create a big risk. Engineers rarely need write rights to production data all day long.
If you rely on group sync, an engineer keeps broad rights for weeks. Reclaiming an idle account thirty days later does not stop a bad query today. During that window, a script or person can drop tables or read secrets. Also, SCIM cannot filter out sensitive fields like emails or card numbers.
Shared database roles make this problem even worse for security teams. Many apps map a whole engineering group to one strong database role. You cannot see which person ran a specific command in the audit log. You also cannot approve a single action without giving away the whole role.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Does deprovisioning a user delete their past work in an app?
In most tools, deprovisioning via SCIM only deactivates the user login. It frees the paid seat while keeping their past files and audit logs.
How fast does SCIM reclaim a license after a group change?
Sync speed depends on the schedule set by your identity provider. Most providers push group updates within a few minutes to an hour.
Can SCIM control which database queries a user can run?
No, SCIM only creates, updates, or disables user accounts and role assignments. It cannot inspect or block live commands inside a session.