You just added another engineer to your team. In theory, their access to observability data should be instant. In practice, you are stuck flipping permissions between your identity provider and Lightstep. The ticket queue grows, the dashboards wait, and your SRE sighs. That is exactly the gap Lightstep SCIM exists to close.
Lightstep SCIM (System for Cross-domain Identity Management) links your identity provider, such as Okta or Azure AD, with Lightstep’s observability platform. It keeps user identities, roles, and groups in sync automatically. No one has to remember who changed what or when. The integration speaks the same language as OAuth and OIDC, allowing identity flows that are auditable and repeatable instead of sticky-notes taped to the monitor.
The magic lies in automation. SCIM defines a JSON-based schema so your identity system can push user data into Lightstep without custom scripts. When someone joins the “Platform Ops” group in Okta, they appear in Lightstep with the correct access level. When they leave, their permissions vanish. It eliminates orphaned accounts before they ever exist.
How do I connect Lightstep and SCIM?
Set up SCIM by creating a provisioning integration in your identity provider and mapping roles to Lightstep teams. Once tokens are generated, the sync begins on its own. No sync cron needed, no manual exports.
To keep things smooth, map your roles clearly. Align Lightstep projects with your IAM groups. Rotate tokens quarterly like you would for AWS IAM keys. When provisioning errors appear, most come from group name mismatches, not broken APIs.