š This feature is for our Enterprise plan customers
If you wish to upgrade your plan to Enterprise, please book a demo
SCIM is currently offered as a beta feature. Contact your Customer Success Manager for the latest setup guidance and any beta limitations that may apply.
Important Notes
You need to have an active WorkOS SSO connection for Synthesia, see How do I set up SCIM directory sync?
SCIM User schema used by Synthesia:
urn:ietf:params:scim:schemas:core:2.0:User.By default, new users land in the workspace set as Default in your Synthesia Organization settings (Settings ā Collaboration ā Auto-capture new users from listed domains (must be enabled) ā Default workspace)
User Management in Okta
After you set up the SCIM app in Okta:
Go to Directory and select Profile Editor
Select App and then select Add Attribute to set up user roles.
Assign users (and/or groups) to the SCIM app.
On assignments, select Assign to Groups.
Once assigned, their Synthesia accounts will be created and added to the default workspace in Synthesia (unless a push group or other logic overrides it).
In the dialog box, select Override on the User Type field, type the desired license for all members of this group. We currently support only the organization-admin role value.
āļø You are able to use different groups for admins and license settings. The above is just an example.
Synthesia supports userType values:
org-full-licenseorg-free-licenseorg-restricted-license.If none is specified, the workspaceās Default license is applied.
š” Required roles format (multi-valued) we accept:
"roles": [ { "type": "synthesia_role", "value": "organization-admin" } ]If you donāt have a role or userType attributes in Okta SCIM provisioning, you can add these custom attributes in the Okta Profile Editor for the SCIM application.
Then you can map these attributes to existing ones in the SCIM app.
Mappings ā Okta User to SCIM App:
Map
user.synthesiaRoleāroles[type eq "synthesia_role"].valueMap
user.userTypeāuserType
Deprovisioning
āļø We donāt delete the accounts. We remove them from the workspace, and the content is transferred to the oldest Organization Admin in a folder named with the userās email.
āļø If the user held the organization-admin role in Synthesia, revoke that role in Synthesia first. Deprovisioning through SCIM does not complete for a user who still holds this role.
In the SCIM Appās Provisioning tab ā ensure Deactivate Users is enabled.
Off-boarding workflow:
Unassign the user from the SCIM app or
Deactivate the userās Okta account in the app.
Synthesia will handle the account removal from the workspace and the content-transfer logic.
User Management in Entra AD
In the SCIM app:
In the Provisioning tab, go to Attribute Mappings
Select Edit Provision Azure Active Directory Users
Show Advanced Options
Select Edit attribute list (if needed) so that
rolesis available as an attribute.
For userType attribute, Synthesia supports values:
org-full-licenseorg-free-licenseorg-restricted-licenseIf none is specified, the workspaceās Default license is applied.
š Please check this PDF guide on how to assign a license role to a group and map userType in Microsoft Entra ID
Deprovisioning
āļø We donāt delete the accounts. We remove them from the workspace, and the content is transferred to the oldest Organization Admin in a folder named with the userās email.
In the SCIM Appās Provisioning tab ā ensure Deactivate Users is enabled.
Off-boarding workflow:
Unassign the user from the SCIM app or
Deactivate the userās Okta account in the app.
Synthesia will handle the account removal from the workspace and the content-transfer logic.
Push Groups ā Workspaces
In both Okta and Entra AD, you can push Groups to Synthesia, but only when the Push Group name exactly matches a workspace name in Synthesia.
For example:
Create an Okta group named āMarketing Workspaceā. If the workspace in Synthesia is exactly āMarketing Workspaceā, when you push that group, all its members will be added to the āMarketing Workspaceā in Synthesia.