How to set up SCIM user provisioning
Estimated 4 minute read
|
Updated Mar 24, 2026, 12:00 AM EST
You will learn
Learn how to set up a system for cross-domain identity management (SCIM) user provisioning in an account or portfolio.
You must have a paid plan and be an Admin or Owner to set up this feature.
Before you begin
You also have SSO turned on in Klaviyo before you set up SCIM.
Note that SCIM provisioning is often an add-on for identity providers (IdPs). For instance, IdPs often require a separate SCIM plan in addition to an SSO plan. If you don't see the following steps in your IdP, please confirm you have the correct plan.
Turn on SCIM user provisioning
- Click your organization name in the lower left corner.
- Click Settings > Security.
- Check the SCIM Provisioning box.
- Copy or download the access key, including the prefix
Klaviyo-API-Key.
Note that this key is only shown once, so make sure you can access it. If copying it, paste it somewhere secure immediately.
- Click Done.
- Copy the base URL and paste it somewhere, preferably where you stored the access key.
Next, you must go to your SSO provider to finish the process. This process varies by provider. Below, we have instructions for OKTA, One Login, and Azure, although you can set it up using any other provider.
OKTA
- Navigate to Application > Applications.
- Select the Klaviyo app.
- Go to the Sign On tab.
- Under Credential Details, check that:
- Application username format is set to Email.
- Update application username on is set to Create and update.
- Click into the General tab.
- Select Edit.
- Under Provisioning, select SCIM.
- Click Save.
- Click into the Provisioning tab.
- Select Edit to open the SCIM Connection page (shown below).
- In SCIM connector base URL, paste the base URL from Klaviyo.
- For Unique identifier field for users, type in “userName.”
- Under Supported provisioning actions, check the following boxes:
- Import New Users and Profile Updates
- Push New Users
- Push Profile Update
- Change the Authentication Mode option to HTTP Header.
- Paste in the access key under Authorization.
- Click Test Connector Configuration.
- Click Save.
- Next to Provisioning to App, click Edit.
- Check Enable for the following features:
- Create Users.
- Update User Attribute.
- Deactivate Users.
- Click Save.
- Scroll down to your app’s attribute mappings section.
- Click Go to Profile Editor.
- Click Add Attribute.
- Type “role” for Display name, Variable name, and External name.
- In External namespace, enter the following:
urn:ietf:params:scim:schemas:core:2.0:User - Check the box for Define enumerated list of values.
- Add in the roles and values; valid role values are as follows:
- admin
- manager
- analyst
- campaign_coordinator
- content_creator
- support
- Scroll down to Attribute required and check Yes.
- Choose the attribute type (personal or group).
- Recommended: leave the User permission as Read Only.
- Click Save.
- Navigate to Applications > Applications and then select your app.
- Click Assign.
- Choose whether to assign the app to an individual (i.e., people) or to a group.
- Find the people or groups you want to assign Klaviyo to, and click Assign next to their name(s).
- Scroll down to the role field and assign them the correct role.
- Click Save and go back.
One Login
- In the Admin Portal, click Applications.
- Click Add App.
- Search “Klaviyo.”
- Click Klaviyo to add it.
- Optional: Rename the connection.
- Click Configuration.
- In the SCIM Bearer Token field, paste your SCIM access key.
- Click Enable under API Connection.
- Click Save.
- Go to Provisioning in the left sidebar.
- Check the Enable Provisioning box.
- Do not uncheck the Create user, Delete user, or Update user boxes.
- Recommended: select Delete in the dropdown for When users are deleted in OneLogin, or the user's app access is removed, perform the below action.
- Click Save.
Microsoft Entra ID (formerly Azure AD)
- Log into Microsoft Entra ID.
- Click Microsoft Entra ID (formerly called “Azure Active Directory”)
- Click Enterprise Applications on the left side.
- Select your application.
- If you haven’t created your application yet, follow the steps in the SSO guide.
- Click Provisioning on the left, then select Get Started.
- In the field named Provisioning Mode, select Automatic.
- Go to the Admin Credentials.
- Paste the SCIM base URL from Klaviyo into the Tenant URL field.
- Paste the SCIM API key into the Secret Token field. Note that this token should be pasted in without any prefixes (e.g., don’t include "Bearer" or "Klaviyo-API-Key").
- Test the connection.
- Once the connection is successful, click Save in the upper left.
- In that same page, scroll down and open the Mappings dropdown.
- Select Provision Azure Active Directory Users.
- Optional: delete non-supported attributes. Note that Klaviyo only supports the following attributes in customappsso Attribute column for SCIM:
- "userName"
- "active"
- emails[type eq "work"].value'
- "name.givenName"
- "name.familyName"
- emails[primary eq "True"].value'
- roles[primary eq "True"].value'
- SingleAppRoleAssignment([appRoleAssignments])
- appRoleAssignments is not supported
- Please use "Expression" as mapping type if using SingleAppRoleAssignment
- Click Save and then click Home.
- Navigate back to Microsoft Entra ID > Enterprise applications > Klaviyo > Provisioning.
- Select Start Provisioning.
Now, Microsoft Entra ID will begin provisioning your users on a schedule. For more insight into which users it has provisioned, select View provisioning logs.
Additional resources
- How to set up single sign-on (SSO)
Learn how to set up single sign-on (SSO) for your Klaviyo account or portfolio. Currently, only identity provided (IdP) single sign-on is supported in Klaviyo.
- Troubleshoot SSO and SCIM errors
Learn how to troubleshoot errors for single sign-on (SSO) with Klaviyo. This article is meant for those familiar with SSO, such as IT professionals.
- How Klaviyo billing works
Learn how Klaviyo bills customers for Profiles and Emails, Mobile Messaging, Reviews, Advanced Klaviyo Data Platform (formerly “CDP”), Marketing Analytics, Customer Hub, Helpdesk, and Customer Agent.
Was this article helpful?
Use this form only for article feedback. Learn how to contact support.