With SCIM 2.0, your directory creates accounts for people who join, suspends those who leave, and keeps groups up to date. Any directory that sends its accounts over SCIM 2.0 works, Microsoft Entra ID for example.
Before you startLink to the Before you start section
- The organization must be a managed organization with at least one verified domain: the directory only creates accounts whose address is on a verified domain.
- The directory does not create members in a workspace paid by card: each member would add a billed seat. In that case, invite people instead. An organization under contract does not have this limit.
- The token is created with the “Manage security” permission (owner, admins).
Connect the directoryLink to the Connect the directory section
- Admin console › “Sign-in” › “Directory synchronization (SCIM)” card › “Create a token”.
- Copy the token right away: it starts with
moai_scim_and will not be shown again. - In your directory, create a SCIM 2.0 application and give it: - the “SCIM service URL” shown by Moon AI:
https://; - the token as the “secret token” (bearer token authentication).chat.realmoon.ai/ api/ v1/ orgs/ scim/ v2 - Run a first sync from the directory.
The card then shows when the token was created, who created it, and when it was last used.
What the directory doesLink to the What the directory does section
| In the directory | In Moon AI |
|---|---|
| A person is assigned to the application | Their account is created if it does not exist, or their existing account is linked, and they become a member. An account created this way is managed by the organization. |
| A person is deactivated | They are suspended in the organization and their sessions are closed. Their seat is freed. |
| A person is reactivated | Their suspension is lifted, if the directory suspended them. A suspension made in the admin console stays. |
| A person is removed | They leave the organization. Their account stays, unless the directory created it and it was never used: it is then deleted. |
| A group is pushed | It becomes an organization group, marked “From the directory”, whose members follow the directory. |
Groups created by the directory can only be changed from the directory. They cannot grant the admin role.
What the directory does not doLink to the What the directory does not do section
- It does not suspend or remove the organization’s owner or admins.
- It does not change an account’s email address.
- It only changes the name of accounts it created or that are on a verified domain.
- It does not create a member when every seat is taken: Moon AI responds with
Tous(every seat in the organization is taken), which your directory shows in its sync logs.les sièges de l’organisation sont occupés.
Replace or revoke the tokenLink to the Replace or revoke the token section
- “Replace token”: the current token stops working at once. Paste the new one into your directory right after.
- “Revoke”: your directory can no longer create, change or remove members. Members already there stay.
An organization has only one SCIM token at a time. The requests it accepts are detailed in SCIM in the Organizations API.