Remove people automatically when they leave (SCIM)

Once single sign-on is on for your organisation, your identity provider can also manage who has a SwfTap work account. When someone leaves (you unassign, disable or delete them in your identity provider), SwfTap removes their work account automatically. Only an Admin of a Team or Enterprise organisation can set this up, under Settings > Team > Single sign-on > User provisioning (SCIM).

What happens when someone leaves

• •They're signed out of SwfTap everywhere at once, on the web and in the app.
• •Their work account is deleted: their membership of your organisation ends, and profiles your organisation assigned to them are deleted. Your organisation's default profile stays.
• •Anything they created in your organisation, such as links, QR codes and documents, is handed to your longest-standing admin, so nothing is lost.
• •They can't sign in with your single sign-on again until your identity provider turns them back on.
• •Their personal SwfTap account (a password or Google account with the same email) is never touched, and nor are its profiles.

If someone comes back and your identity provider turns them on again, they can sign in with SSO again. They get a fresh work account that joins your organisation as usual; their old work profiles aren't restored.

1. Generate a token

Go to Settings > Team > Single sign-on and find User provisioning (SCIM). Copy the Tenant URL, then select Generate token and copy the secret token. It's shown only once: if you lose it, select Rotate token (the old one stops working straight away). Revoke token turns provisioning off.

2. Microsoft Entra ID

• •In the Microsoft Entra admin centre, open Enterprise applications and select the SwfTap app you set up for single sign-on.
• •Go to Provisioning, choose New configuration (or Get started) and set Provisioning Mode to Automatic.
• •Paste the Tenant URL into Tenant URL and the token into Secret Token, then select Test Connection and Save.
• •Under Mappings, turn off Provision Microsoft Entra ID Groups (SwfTap provisions people, not groups). For users, map objectId to externalId (Entra maps mailNickname by default: change it), and userPrincipalName (or mail) to userName. userName must be their email address on your verified domain.
• •In Single sign-on, make sure the Unique User Identifier (Name ID) is user.objectid with the Persistent format, the same id as externalId. That's how SwfTap knows whose work account is whose.
• •Set Provisioning Status to On. Entra syncs about every 40 minutes, and you can use Provision on demand to test one person straight away.

3. Okta

• •Open the SwfTap SAML app in the Okta Admin Console. On the General tab, edit App Settings and set Provisioning to SCIM.
• •On the Provisioning tab, paste the Tenant URL into SCIM connector base URL and set Unique identifier field for users to userName.
• •Choose Push New Users and Push Profile Updates, set Authentication Mode to HTTP Header, paste the token, then test and save.
• •Under Provisioning > To App, turn on Create Users, Update User Attributes and Deactivate Users. Keep the application username format as Email.
• •Okta sends its user id as externalId. In the app's SAML settings, add the attribute statement urn:oasis:names:tc:SAML:attribute:subject-id = user.id (the plain id, not a scoped value like id@domain) so sign-ins carry the same id.

Google Workspace

Google only provisions apps from its own catalogue, so it can't send SCIM to SwfTap. When someone leaves, turn the SwfTap app off for them (or suspend them) in the Google Admin console so they can't sign in, then remove them under Settings > Team.

Good to know

• •A token only manages people on your verified domain. Addresses on any other domain are refused.
• •Adding someone through SCIM doesn't create a password for them. They join your organisation the first time they sign in with SSO, while a seat is free.
• •If a work account can't be deleted (for example it's your organisation's only admin), it's signed out and blocked instead. The panel lists it under Couldn't fully remove with the reason and a Try again button, and the Team members list shows it as Blocked. It still uses a seat until it's removed. If your identity provider turns the person back on, the block is lifted.
• •SwfTap identifies people by your identity provider's immutable user id (externalId, and the same id as the SAML NameID), never by email. Renaming someone, changing their email or giving an old address to a new person never moves or removes anyone else's work account. externalId is required and can't be changed.
• •SCIM needs the immutable id as the NameID. If any team member still signs in with another NameID (an email address, or a value like sAMAccountName), SwfTap won't turn SCIM on (and pauses it if it's on), and Settings > Team > Single sign-on lists who. Switch the NameID to the immutable id: each person gets a new work account at their next sign-in, so remove their old accounts from the team. SCIM resumes by itself once none are left.
• •Each sign-in identity gets its own SwfTap account: SwfTap never joins two identities into one account by matching email addresses. So a person whose identity changes (a new identity provider, or a NameID change) gets a new, empty work account, and their old account stays until you remove it. SwfTap can't move the old account's data across automatically.
• •If an account from before this protection ever holds two people's identities, nobody can sign in to it until you detach the identity that was added later under Settings > Team > Single sign-on. The account owner's identity (the one that created it) can't be detached.
• •A blocked account that couldn't be deleted keeps its address. If that address now belongs to someone new, select Release address under Couldn't fully remove so they can sign in.
• •Last sync shows when your identity provider last called SwfTap. SwfTap support can also revoke a token for you if it has leaked.