Air-gapped deployment is not a theory. It’s a requirement in environments where security isn’t optional—defense networks, regulated industries, critical infrastructure. When nothing can connect to the public internet, even provisioning users becomes a challenge. That’s where SCIM provisioning for air-gapped systems comes in. Done right, it keeps user data in sync without breaking the isolation that keeps the environment secure.
SCIM (System for Cross-domain Identity Management) automates the creation, updating, and removal of users across systems. In a connected deployment, this usually means talking directly to an identity provider in the cloud. In an air-gapped deployment, the process cannot rely on live calls across networks. You need a system that respects the gap but still delivers real-time or near real-time identity updates within the secure zone.
The challenge is twofold:
First, you must handle SCIM endpoints inside the air-gapped network that can receive provisioning requests from an internal identity provider.
Second, you need a secure, reliable way to transfer updated identity data from the outside world into the internal network, without ever opening inbound internet access. This often involves controlled file drops, offline sync agents, or specialized bridges that meet audit and compliance rules.