Feature:
Inbound SCIM provisioning for Auth0 Team members, tenant access, and Dashboard roles
Description:
Add SCIM support for provisioning and deprovisioning Auth0 Team members, including assigning access to specific Auth0 tenants and their Dashboard roles (e.g. Viewer - Config Settings).
Ideally, IdP groups could be mapped to tenant access and Dashboard roles, allowing users who belong to multiple groups to receive the combined set of appropriate roles across one or more tenants.
The existing Teams API could potentially be used to build this ourselves, but doing so requires implementing and operating custom provisioning, role mapping, reconciliation, deduplication, deprovisioning, retries, and audit logic. This is functionality that SCIM would normally provide. Furthermore the Teams API is currently in beta.
Use-case:
We manage Auth0 administrative access centrally through our identity provider. Different teams require different levels of access to our Auth0 tenants, and individual users may belong to multiple groups that grant different Dashboard roles.
We would like to manage this using standard identity governance processes, for example:
IdP group membership → Auth0 Team membership → tenant access → Dashboard role(s)
When someone joins, changes team, or leaves, changes in our IdP should automatically provision, update, or remove their Auth0 access.
Supporting this through SCIM would allow us to use our existing joiner/mover/leaver and access-management processes, rather than building maintaining a custom integration against the Auth0 Teams API (in beta).