Directory sync (SCIM) - Wave Connect

Available on the Enterprise plan. Only organization owners can configure Directory Sync.

Overview

SCIM (System for Cross-domain Identity Management) 2.0 connects Wave Connect to your identity provider so user accounts are managed automatically. When you add, update, or remove a user in your IdP, the change is reflected in Wave Connect without any manual action. Wave Connect exposes the SCIM Users and Groups resources with GET, POST, PUT, PATCH and DELETE. Filters support a single top-level eq comparison, which is what identity providers use to look up a user by userName or externalId.

Setup

Open Directory Sync

Go to Settings → Security. On the Directory Sync card, click Configure to open the Configure SCIM modal.

Copy the SCIM endpoint

The SCIM Endpoint is https://app.wavecnct.com/api/scim. Copy it. Your identity provider calls it the tenant URL or base URL.

Create a SCIM token

Click Create Token, give the token a name and click Create. Copy the token immediately. It is only shown once. The token is sent by your IdP as a bearer token.

Configure your identity provider

In your IdP, set up automatic provisioning for Wave Connect using the endpoint and token. Map your user attributes to the SCIM attributes below.

Test provisioning

Assign a test user in your IdP and verify their Wave Connect account appears in Users with the right name, email and team.

SCIM tokens also appear on the Tokens card in Settings → Security, with the Manage SCIM scope. You can delete a token there to cut off your IdP. Tokens are deleted automatically if the organization leaves the Enterprise plan.

Identity provider guides

Microsoft Entra ID

Step-by-step enterprise application setup, attribute mappings and offboarding.

Okta and Google Workspace

Follow the generic steps on this page. Use the endpoint as the base URL and the token as the bearer token.

Attribute mapping

Wave Connect reads these attributes from the SCIM User resource:

SCIM attribute	Wave Connect field
`userName`	Stored as the username. Used as the account email only if no primary email is sent on creation
`name.givenName`	First name (required)
`name.familyName`	Last name (required)
`emails[primary eq true].value`	Account email and login email (required on updates)
`emails[type eq "work"].value`	Work email
`emails[type eq "personal"].value`	Personal email
`phoneNumbers[type eq "mobile"].value` or `[type eq "personal"]`, else the primary phone	Account phone and mobile phone
`phoneNumbers[type eq "work"].value`	Work phone
`addresses[primary eq true].locality`, else `[type eq "work"]`, else the first address	City
`title`	Job title
`locale`	Language (`preferredLanguage` is ignored)
`active`	Active or deactivated
`roles[].value`	Organization role: `USER`, `ADMIN` or `OWNER` (uppercase)
`externalId`	External ID, stored for lookups

Phone numbers are validated and stored in international format. Invalid values and extension-only placeholders are dropped instead of failing the request. A locale that Wave Connect does not support falls back to English. The enterprise extension department is not stored on the profile. Department-based team assignment can be enabled by Wave Connect support. When a user is created and the email already belongs to a member of your organization, the existing member is updated instead. If the email belongs to a personal Wave Connect account on one of your verified domains, that account is moved into your organization and kept, including its card and contacts.

Teams mapping

When SCIM is enabled, groups in your identity provider are synced to Wave Connect as teams. For example, groups assigned to the Wave Connect application in Microsoft Entra ID are automatically created as teams in Wave Connect. Members assigned to a group are added to the corresponding team. The group displayName becomes the team name and the group externalId is stored on the team. If a team with the same name already exists, the group is merged into it. A user belongs to one team, so if a user is in several groups the last one provisioned wins. An organization can have up to 75 teams. Deleting a group deletes the team. Its users are kept and its contacts are moved to the organization. This lets you manage your Wave Connect team structure directly from your IdP, with no manual team setup needed in Wave Connect. Each Wave Connect team can have a different template assigned, so users in different groups automatically get the right card layout, branding, and locked fields for their department or role. See Templates for details.

Deprovisioning

When a user is unassigned from the Wave Connect application in your IdP, the IdP sets active to false. Wave Connect deactivates the account:

The user can no longer log in and their sessions are revoked.
They appear with a SUSPENDED badge in Users.
Their NFC card stays linked, and their profile and contacts are preserved.
They still count as a seat until they are deleted.

Setting active back to true (for example by reassigning the user) reactivates the account. When your IdP sends a DELETE request, Wave Connect permanently deletes the user: their profile and contacts are removed and their NFC card is unlinked so it can be assigned to someone else.

Some identity providers (such as Microsoft Entra ID) suspend user accounts for a 30-day grace period before permanently deleting them. By default, Wave Connect follows this behavior and deactivates the account during that period. To skip the grace period, open Settings → Security → Directory Sync → Configure and enable Delete user immediately instead of suspending. Deactivation then permanently deletes the user right away.