Accounts that follow people.

1. HR
2. IdP
3. App

1. new hire: Ada, Finance

   Step 1 of 6

   Joiner: HR records a new hire

   In plain words HR tells reception that Ada starts on Monday.

   The HR system is the source of truth. The IdP imports the new person and assigns apps based on rules such as department and role.

2. POST /scim/v2/Users

   Step 2 of 6

   The account is created in the app

   In plain words Reception prepares Ada’s badge before she arrives.

   The IdP calls the app’s SCIM endpoint with a standard JSON user. No CSV, no ticket: the account is ready on day one.

   POST https://app.example.com/scim/v2/Users
   Authorization: Bearer …
   
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
     "externalId": "E-10423",
     "userName": "ada@example.com",
     "name": { "givenName": "Ada", "familyName": "Lovelace" },
     "active": true
   }

3. 201 Created · id

   Step 3 of 6

   The app returns its own id

   In plain words Reception notes the badge number next to Ada’s name.

   The IdP stores the id chosen by the app and uses it for every later change. externalId links back to the HR record.

   201 Created
   { "id": "2819c223", "userName": "ada@example.com", "active": true, … }

4. mover: PATCH /Groups

   Step 4 of 6

   Mover: Ada changes team

   In plain words Ada moves floor: her badge opens the new doors and stops opening the old ones.

   When HR moves Ada from Finance to Audit, the IdP adds her to the new group and removes the old one. Removing is the part that is often forgotten, and it is how privileges pile up.

   PATCH https://app.example.com/scim/v2/Groups/finance
   { "Operations": [{ "op": "remove", "path": "members[value eq \"2819c223\"]" }] }
   
   PATCH https://app.example.com/scim/v2/Groups/audit
   { "Operations": [{ "op": "add", "path": "members", "value": [{ "value": "2819c223" }] }] }

5. leaver: last day

   Step 5 of 6

   Leaver: Ada leaves the company

   In plain words HR tells reception that today is Ada’s last day.

   The termination in HR is the trigger. The IdP disables the identity at once, so no new sign-in can start anywhere.

6. PATCH /Users · active=false

   Step 6 of 6

   The account is disabled everywhere

   In plain words The badge stops working on every door at the same moment.

   Disabling rather than deleting keeps the audit trail. Good apps also end active sessions. Without this step, former employees keep access to SaaS apps for months.

   PATCH https://app.example.com/scim/v2/Users/2819c223
   {
     "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
     "Operations": [{ "op": "replace", "path": "active", "value": false }]
   }

Flow complete.