Skip to main content

Setting up SCIM provisioning for Label Studio Enterprise

Tyler Conlee
Updated

Before you begin

SCIM (System for Cross-domain Identity Management) automates user and group provisioning into Label Studio Enterprise from your identity provider. SCIM interacts with your SSO integration, so SSO must already be configured first. You'll also need a Legacy token associated with your organization's Owner account.

Set up SCIM with Okta

  1. In Okta, go to Applications > Applications, open your Label Studio Enterprise application, select the General tab, and enable SCIM provisioning.
  2. On the Provisioning tab, under Integration, set:
    • SCIM connector base URL: https://<your-instance>/scim/v2/
    • Unique identifier field for users: email — use email, not username, or SCIM won't work correctly for users created before the SCIM integration.
    • Authorization: Bearer token, using the Legacy token from the Owner account.
  3. Enable Create Users, Update User Attributes, and Deactivate Users under the "To App" provisioning settings.
  4. Assign the application to users or groups from the Assignments tab.
  5. In Label Studio, go to Organization > SCIM to map Okta groups to organization roles and workspaces. You can map multiple groups to the same role or workspace.

Set up SCIM with Microsoft Entra ID (Azure AD)

  1. In the Microsoft Entra admin center, go to Enterprise apps, select your application, and open Provisioning.
  2. Set the Tenant URL to https://<your-instance>/scim/v2/ and the Secret Token to your Owner account's Legacy token.
  3. Under Mappings, remove all attribute mappings except: emails[type eq "work"].value, userName, active, name.givenName, and name.familyName. Unsupported attributes (like displayName or externalId) cause HTTP 501 errors during provisioning.
  4. Enable group provisioning under Mappings if you want group-based role assignment, then configure group mapping in Label Studio the same way as the Okta steps above.

Common issues

  • Users aren't deprovisioned when removed from the IdP — usually means SCIM deprovisioning isn't enabled/supported on the IdP side, or the SCIM base URL is misconfigured.
  • HTTP 501 errors during provisioning (Entra ID) — caused by unsupported attribute mappings; remove anything outside the supported list above.
  • Users provisioned but in the wrong workspace or role — check your group-to-role and group-to-workspace mapping under Organization > SCIM; the group name must match exactly what your identity provider sends.

Related articles

  • Common LDAP & SAML SSO Questions
  • Is the Organization Owner role required to setup LDAP?

For the full attribute reference, see Set up SCIM2 for Label Studio in our documentation.