Available on the Enterprise plan.
Overview
SCIM (System for Cross-domain Identity Management) 2.0 connects Wave to your identity provider so user accounts are managed automatically. When you add, update, or remove a user in your IdP, the change is reflected in Wave without any manual action.Setup
Copy the SCIM endpoint
Your SCIM endpoint URL is displayed. Copy it — you will need it in your identity provider.
Create a SCIM token
Click Create Token to generate a bearer token with SCIM access. Copy it immediately — it is only shown once.
Configure your identity provider
In your IdP, set up automatic provisioning using the SCIM endpoint and the token you created. Map your user attributes to Wave’s schema (see below).
Attribute Mapping
Map these attributes in your identity provider to populate Wave user profiles:| SCIM Attribute | Wave Field |
|---|---|
| givenName | First name |
| familyName | Last name |
| Account email | |
| title | Job title |
| department | Department |
| phoneNumber | Phone |
Teams Mapping
When SCIM is enabled, groups in your identity provider are synced to Wave as teams. For example, groups assigned to the Wave application in Microsoft Entra ID are automatically created as teams in Wave. Members assigned to a group are added to the corresponding team. This lets you manage your Wave team structure directly from your IdP — no manual team setup needed in Wave. Each Wave team can have a different template assigned, so users in different groups automatically get the right card layout, branding, and locked fields for their department or role. See Templates for details.Deprovisioning
When a user is removed from the Wave application in your IdP, their Wave account is deactivated — not permanently deleted. Their NFC card is unlinked and their profile is no longer accessible, but their contacts and data are preserved. The account can be reactivated if needed.Some identity providers (such as Microsoft Entra ID) suspend user accounts for a 30-day grace period before permanently deleting them. By default, Wave follows this behavior and deactivates the account during that period. You can change this in Settings → Security → SCIM by enabling Delete user immediately instead of suspending.