Does SCIM Provisioning require IdPlug Admin SSO?

No. It only requires the free Customer SSO module. With Customer SSO alone you get one provider and one SCIM connection. Admin SSO lifts the provider limit.

What happens when a user is removed in Entra ID or Okta?

The Magento customer is soft-deactivated, never hard-deleted. Order history and customer data are preserved, and active sessions can be signed out automatically.

Which provisioning clients are supported?

Microsoft Entra ID automatic provisioning, including Test Connection and provision on demand, and Okta lifecycle management with Push Groups. Any standards-compliant SCIM 2.0 client works.

How is the SCIM bearer token protected?

The token is shown once, stored only as a hash, can be rotated or revoked at any time, and requests are rate limited. An emergency pause rejects writes while reads continue.

ID idplug.

IDENTITY FOR MAGENTO

EXTENSION

IdPlug SCIM Provisioning for Magento 2

Automate the lifecycle.

Let your identity provider provision Magento customers and groups over SCIM 2.0, so access ends the moment it ends at the source.

IDENTITY FLOW READY

IDIDENTITY PROVIDERCompany IdP······

COMMERCE PLATFORMMagento

BUILT FORAdobe Commerce& Magento Open Source 2.4EDITIONSCIM · Subscriptioncloudstack/id-plug-scimPRICEFrom $299 / yearPer production domain, excl. VATAVAILABILITYRequest accessAdobe Commerce Marketplace listing pending

CAPABILITIES

Identity access that feels native to Magento.

01⇄

SCIM 2.0 service provider

Users, Groups, Schemas, ResourceTypes and ServiceProviderConfig endpoints.

02◈

Idempotent provisioning

Create, update, deactivate and reactivate without duplicate customers.

03◇

PATCH support

Add, replace and remove on nested and multi-value attributes, including membership.

04⌘

Group synchronization

Push groups from the IdP and map them to Magento customer groups.

05↗

Entra ID and Okta ready

Compatible with Entra automatic provisioning and Okta lifecycle management.

06✓

Provisioning logs

Hashed bearer tokens, rate limiting, diagnostics and an emergency pause.

HOW IT FITS

Keep your identity stack.
Connect your store.

IdPlug bridges Magento with your identity provider while keeping access rules explicit and manageable. It runs entirely on your servers and sends nothing to us.

01
Create a SCIM credential
Generate a bearer token on the provider record. It is shown once and can be revoked.
02
Connect Entra ID or Okta
Point automatic provisioning at your store’s SCIM endpoint and run Test Connection.
03
Manage the full lifecycle
Users are created before first login and deactivated when they leave.

SCREENSHOTS

IdPlug SCIM Provisioning in the Magento admin.

Real screens from the current release. Click any image to enlarge.

01 SCIM provisioning settings on the identity provider record.
02 SCIM bearer token, shown once, hashed at rest and revocable.
03 Provisioning diagnostics: endpoint checks, token validation and mapping preview.
04 Provisioning logs with stable error codes for every create, update and deactivation.
05 Customers provisioned from Entra ID before their first login.
06 Emergency pause rejects SCIM writes with a retryable response while reads continue.

PRICING & LICENSING

One subscription per production domain.

The subscription covers one production Magento installation plus any number of development, staging, testing and CI environments that serve it. Buy through the Adobe Commerce Marketplace once the listing is live, or request a direct license from us today. Prices are the same as on the Marketplace and exclude VAT.

Automatic customer provisioning before first login
Microsoft Entra ID and Okta lifecycle management
Deactivation and group synchronization that preserves order history

Read the Commercial License Agreement →

GUIDES

Read before you roll out SCIM Provisioning.

QUESTIONS

IdPlug SCIM Provisioning FAQ.

Does SCIM Provisioning require IdPlug Admin SSO?: No. It only requires the free Customer SSO module. With Customer SSO alone you get one provider and one SCIM connection. Admin SSO lifts the provider limit.
What happens when a user is removed in Entra ID or Okta?: The Magento customer is soft-deactivated, never hard-deleted. Order history and customer data are preserved, and active sessions can be signed out automatically.
Which provisioning clients are supported?: Microsoft Entra ID automatic provisioning, including Test Connection and provision on demand, and Okta lifecycle management with Push Groups. Any standards-compliant SCIM 2.0 client works.
How is the SCIM bearer token protected?: The token is shown once, stored only as a hash, can be rotated or revoked at any time, and requests are rate limited. An emergency pause rejects writes while reads continue.

REQUEST ACCESS

Get IdPlug SCIM Provisioning

Tell us about your store and identity provider. We reply within one business day with access details, pricing and next steps.

01Tell us about your setup
Edition, identity provider and the extensions you need.
02We confirm fit and pricing
Marketplace listing or a direct license for your production domain.
03Install and go live
Composer install, provider setup and a Test Sign-in before rollout.

ALSO IN THE SUITE

Core · Free

IdPlug Customer SSO

SAML 2.0 and OpenID Connect sign-in for Magento customers, with just-in-time provisioning and attribute mapping.

Free →

Pro · Subscription

IdPlug Admin SSO

Single sign-on for the Magento admin with role mapping, multiple identity providers, headless storefront sign-in and private storefronts.

From $249 / year →