Enterprise identity Delivered product work
Bringing enterprise identity lifecycle automation to the platform
Extending enterprise identity capabilities beyond SSO with standardized user provisioning and access management.
General availability scheduled Q4 2026
Overview
Enterprise customers increasingly expect user provisioning to integrate with their existing identity and access management ecosystems. The opportunity was to bring standardized SCIM provisioning to the cloud platform.
- Context
- Without automated provisioning, administrators managed user accounts and access manually.
- My contribution
- I led discovery, defined the supported SCIM contract with Engineering, and led delivery and customer enablement.
Problem
Without automated provisioning, administrators must manually create, update, deactivate, and manage user access. That creates unnecessary work and potential inconsistencies in access and security.
An important distinction: SCIM handles provisioning and lifecycle management; SSO handles authentication. The experience needed to account for both.
What established the problem
- User creation and profile updates.
- Activation and deactivation.
- Group membership and group-driven access.
- License assignment and module and folder permissions.
- Existing-user migration and administrator exceptions.
- Integration prerequisites and troubleshooting.
My contribution
What I did
- Led product discovery and requirements definition.
- Translated enterprise provisioning requirements into a product scope.
- Defined the supported SCIM contract with Engineering, aligning endpoints, operations, and attributes.
- Helped establish a group-driven access model.
- Worked through edge cases involving existing users, administrator access, migration, and deprovisioning.
- Led cross-functional delivery and customer enablement, including the customer-facing enablement guide and FAQ.
Who I worked with
- Engineering
- Design
- Test
- Customer enablement
Decisions & tradeoffs
Product capabilities
Standardized endpoints
- Users
- Groups
Supported operations
- POST, PATCH, DELETE, GET
Core attributes
- Username or email, first and last name, active status, groups, user ID
Group-driven access
- Identity provider groups connect to cloud groups for consistent access.
- Licenses and module or folder permissions are configured in the platform and, where supported, through custom scripts using the platform API.
Implementation considerations
- SSO is configured before SCIM provisioning.
- Administrator accounts are handled as exceptions.
- Existing-user migration is planned before rollout.
- Group membership and access are verified.
- Deactivation and reactivation are supported.
- Customers test with a small group before broader rollout.
Tradeoffs
- Not every identity provider automatically manages every license and permission, so the platform and API cover those cases rather than over-promising provider automation.
Outcomes
Results of team work. Measured outcomes are kept separate from expected benefits.
100%
Adoption among target customers who required this critical integration
How it was measured
- Taken through discovery, product definition, engineering delivery, and customer enablement. General availability has not happened yet, so there are no adoption results.
Expected benefits (not measured)
- Reduced manual user administration.
- More consistent user lifecycle management.
- Better alignment with enterprise security expectations.
- Better scalability across global customer deployments.
- More efficient onboarding and offboarding.
Lessons
- Enterprise integrations require designing for lifecycle edge cases, not just the happy path.
- Security, permissions, and user experience need to be considered together.
- Customer enablement is part of the product experience.
- Standardization can unlock scalability while reducing customer-specific complexity.
Supporting visuals
