System for Cross-Domain Identity Management (SCIM) is an open standard-based solution to help reduce the cost and complexity of user management operations. SCIM centralizes identity, keeping user data in sync between a company’s identity provider (such as OneLogin, Okta, or Microsoft Entra ID) and LinkedIn Sales Navigator. This keeps user attributes synchronized, and enables you to create user profiles, assign and remove user licenses, provision groups and group memberships automatically from within LinkedIn Sales Navigator. SCIM is available to Sales Navigator Advanced and Advanced Plus users.
With SCIM, you can:
- Ensure clean, up-to-date user data in LinkedIn Sales Navigator - SCIM keeps user attributes synchronized between Okta, OneLogin, or Microsoft Entra ID and LinkedIn Sales Navigator. Any learner data changes made within an organization’s identity provider (IdP) will be automatically reflected in Sales Navigator in less than one hour.
- Significantly reduce time and effort spent on user management - Admins can add/remove/manage users at scale, which reduces the time and effort it takes to keep their users up to date.
- Have centralized application management - Customers already have many vendor applications connected via SCIM, and their expectation is to manage LinkedIn solutions centrally in the same way.
- Boost license utilization - Admins can use automated assignments and revocation to free-up licenses not in use.
Important to know
If you have enabled or plan on enabling SCIM for LinkedIn Learning, you must use the same unique identifiers for Sales Navigator and LinkedIn Learning to represent users in SCIM. Please reach out to Support to find out if your company has enabled this for LinkedIn Learning. Learn more.
Here are a few frequently asked questions about SCIM:
SCIM is an industry standard protocol for user management, and Sales Navigator currently supports Okta, OneLogin, and Microsoft Entra ID.
Once enabled, your SCIM token for Sales Navigator remains valid for two years.
No, SCIM can be used and implemented separately and independent of SSO. When administered through the same tool, SSO is for access and authentication, and SCIM is a provisioning service.
Yes, SCIM automates the provisioning of the license, and not the activation. Users will need to activate their own license.
Yes, admins can manually add, remove, and edit users through the admin interface.
Admin users can configure SCIM directly by accessing LinkedIn Admin Center > Settings > Global Settings > SCIM.
No. If you enable SCIM and there are existing groups in Sales Navigator with the same group name, you will receive an error message in your SCIM service provider, preventing you from creating new groups or overwriting existing ones in Sales Navigator.
No. We currently only support the one-way flow of user and group information from the SCIM service provider to Sales Navigator. After SCIM is enabled, the SCIM service provider becomes the source of truth for user and group information, regularly pushing updates to Sales Navigator.
Yes. You have the flexibility to create and manage additional groups in Sales Navigator apart from those created and managed by SCIM. For example, while SCIM may have created regional groups in Sales Navigator for license provisioning, you can independently create and manage groups for SMB, MM, and ENT teams to take advantage of other Sales Navigator features like Usage Reporting.
Yes, but these changes must be made within the SCIM service provider, and not in Sales Navigator. Please note that any changes made to SCIM groups will be reflected across all applications using SCIM, and not just in Sales Navigator. You should consider the impact and benefits of such changes before proceeding.
You can determine which of the 300 representatives are eligible for Sales Navigator licenses. The admin can do so by creating SCIM groups with specific criteria (for example, role, region, industry) to determine who qualifies for Sales Navigator license provisioning.
If there are still more representatives meeting the criteria than the 100 licenses available, the licenses will be provisioned automatically to the first 100 people, typically in the order of their employee number or name alphabetically. Subsequently, the admin will receive an error message in the SCIM service provider, indicating that more licenses are needed.
Yes, you can provision TeamLink Extend Licenses (TLE) through SCIM. You’ll need to create a second application for the TeamLink Extend provisioning. The token generated for the TLE licenses will be provided to the second application for SCIM to manage them independently of the full Sales Navigator licenses.
Yes. However, it’s essential to note that if a user’s Sales Navigator license is provisioned manually, it will also need to be removed manually when the user leaves the company.
There is one exception - if at a later point, a user who was initially manually provisioned becomes eligible for SCIM provisioning (for example, they are moved to a SCIM group that meets the criteria for Sales Navigator provisioning), SCIM will take over and automatically remove their license when they leave the company or when they no longer meet the criteria for Sales Navigator provisioning.
SCIM carries over the following information to Sales Navigator:
- First name
- Last name
- Department
- Title
- Email address
- Employee identifier/ personal number
SCIM and SSO are two distinct features that contribute to data security but address different aspects of the security landscape. SSO primarily resolves authentication challenges, including scenarios like recognizing atypical behaviors (for example, logging in from San Francisco and then from New York City two hours later). On the other hand, SCIM is designed for the automatic management of user licenses, particularly in tasks such as automatically removing licenses when a user leaves the company.
It's important to note that SCIM and SSO can be enabled either together or independently, depending on the specific needs and preferences of your organization.
SCIM integration guides