> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinq.me/llms.txt
> Use this file to discover all available pages before exploring further.

# How SCIM provisioning works

> What Blinq does when your directory creates, updates, or deactivates a user, whichever identity provider you use.

<Info>
  SCIM provisioning is available on **Enterprise** plans, and is enabled per workspace. [Talk to your account team](mailto:support@blinq.me) to switch it on.
</Info>

Blinq exposes a SCIM 2.0 endpoint that your identity provider pushes changes to, authenticated with a bearer token you generate in Blinq. Your directory is the source of truth, and Blinq never pushes back to it.

This page covers what happens inside Blinq. It applies the same way whether you provision from Microsoft Entra ID or Okta.

## Before you provision anyone

Set up the Blinq side first. Provisioning creates cards immediately, so it's much easier to get the template right beforehand than to correct cards afterwards.

<Steps>
  <Step title="Create your team template">
    Build the template that provisioned cards will use, then lock or hide any card fields you don't want the directory to control.
  </Step>

  <Step title="Attach it in Card Settings">
    Go to **Settings → Integrations** and attach the template under the provisioning card settings.
  </Step>

  <Step title="Turn activation emails off while you test">
    This keeps test users from being emailed. Turn it back on when you're ready to roll out.
  </Step>
</Steps>

<Warning>
  **Provision people who aren't already in your workspace.** SCIM creates users — there's no documented step that reconciles someone who was already added by hand. Don't bulk-delete existing members to make way for provisioning either; check them individually instead, and ask Blinq support how your workspace should handle the overlap.
</Warning>

## Creating a user

Assigning a user to Blinq in your directory creates their Blinq account and a digital business card. Blinq populates the card from their directory profile, applies any matching team template, and — if the activation email is switched on — emails them so they can activate their account.

## Updating a user

When an attribute changes in your directory, the change flows to the card on the next sync. Only attributes with an active mapping are updated.

## Deactivating a user

Unassigning a user in your directory, or disabling or deleting their directory account, deactivates them in Blinq.

Deactivated users don't count toward your Blinq user count, so the seat is freed for someone else.

## Reactivating a user

If you re-assign someone who was previously removed, Blinq matches them on email address and reactivates them rather than creating a second account.

## Fields the directory manages

Each field on a provisioned card can be **locked**, so the card owner can't change it, and **linked**, so later directory changes flow through to it. You control this per field on the team template you attach for provisioning.

If an admin edits a linked field in Blinq and saves, that field becomes **unlinked** — the change stands, and later directory updates won't overwrite it. Removing a lock so the card owner can edit a field has the same effect.

<Warning>
  **Unlinking is per field and it's easy to do by accident.** A card where several fields have been hand-edited will quietly stop accepting directory updates for those fields, even though the rest of the card keeps syncing. If directory values aren't appearing on a card, check which of its fields are still linked before looking anywhere else.
</Warning>

## Team templates

Team templates apply to newly created cards only, and can be filtered on directory attributes — for example, apply the Sales template when `department` is Sales. After a user has been provisioned, assign templates to their card manually from the dashboard.

Template values take precedence over directory values. If your directory says the company is `Blinq` and the applied template says `Blinq Inc.`, the card shows `Blinq Inc.`

<Warning>
  Precedence isn't the only way a directory value can go missing. If the applied template has no field for an attribute, the value simply won't appear on the card. Job title is the most common case.
</Warning>

## Activation emails

With the activation email switched on, users are emailed as soon as they're provisioned. With it off, no email is sent and admins send activation emails manually from the **Team Cards** page.

<Warning>
  **The activation link is a non-SSO entry path.** A user who onboards through the claim link in that email doesn't pass through your identity provider. If every user must enter through SSO, switch the activation email off and direct people to sign in instead.
</Warning>

## Who owns the SCIM token

Provisioning stops if the admin who generated the SCIM token is deactivated or loses the admin role. A current workspace admin then has to generate a new token and re-enter it in your identity provider.

<Warning>
  Because SCIM is often what deprovisions people, it's possible to break your own provisioning by offboarding the admin who created the token. Check who owns it before removing an administrator.
</Warning>

<hr />

### Need help?

For any questions or issues, [contact Blinq support](https://support.blinq.me/en/) or email [support@blinq.me](mailto:support@blinq.me).