> ## Documentation Index
> Fetch the complete documentation index at: https://wavecnct.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Directory Sync (SCIM)

> Automate user provisioning and deprovisioning with your identity provider

<Info>
  Available on the **Enterprise** plan.
</Info>

## Overview

SCIM (System for Cross-domain Identity Management) 2.0 connects Wave to your identity provider so user accounts are managed automatically. When you add, update, or remove a user in your IdP, the change is reflected in Wave without any manual action.

## Setup

<Steps>
  <Step title="Go to Settings → Security → SCIM">
    Open the SCIM configuration panel in your Wave admin dashboard.
  </Step>

  <Step title="Copy the SCIM endpoint">
    Your SCIM endpoint URL is displayed. Copy it — you will need it in your identity provider.
  </Step>

  <Step title="Create a SCIM token">
    Click **Create Token** to generate a bearer token with SCIM access. Copy it immediately — it is only shown once.
  </Step>

  <Step title="Configure your identity provider">
    In your IdP, set up automatic provisioning using the SCIM endpoint and the token you created. Map your user attributes to Wave's schema (see below).
  </Step>

  <Step title="Test provisioning">
    Assign a test user in your IdP and verify their Wave account is created correctly.
  </Step>
</Steps>

## Attribute Mapping

Map these attributes in your identity provider to populate Wave user profiles:

| SCIM Attribute | Wave Field    |
| -------------- | ------------- |
| givenName      | First name    |
| familyName     | Last name     |
| email          | Account email |
| title          | Job title     |
| department     | Department    |
| phoneNumber    | Phone         |

## Teams Mapping

When SCIM is enabled, groups in your identity provider are synced to Wave as teams. For example, groups assigned to the Wave application in Microsoft Entra ID are automatically created as teams in Wave. Members assigned to a group are added to the corresponding team.

This lets you manage your Wave team structure directly from your IdP — no manual team setup needed in Wave.

Each Wave team can have a different template assigned, so users in different groups automatically get the right card layout, branding, and locked fields for their department or role. See [Templates](/templates/overview) for details.

## Deprovisioning

When a user is removed from the Wave application in your IdP, their Wave account is **deactivated** — not permanently deleted. Their NFC card is unlinked and their profile is no longer accessible, but their contacts and data are preserved. The account can be reactivated if needed.

<Info>
  Some identity providers (such as Microsoft Entra ID) suspend user accounts for a 30-day grace period before permanently deleting them. By default, Wave follows this behavior and deactivates the account during that period. You can change this in **Settings → Security → SCIM** by enabling **Delete user immediately instead of suspending**.
</Info>