How to set up SCIM user provisioning

How to set up SCIM user provisioning

Estimated 5 minute read

Updated Mar 24, 2026, 12:00 AM EST

Table of contents

You will learn
Before you begin
Turn on SCIM user provisioning
Additional resources

You will learn

Learn how to set up a system for cross-domain identity management (SCIM) user provisioning in an account or portfolio.

SCIM is available for accounts with a paid plan and for portfolios. To set it up, use an Admin or Owner role in an account, or a Portfolio Admin or Portfolio Owner role in a portfolio.

Before you begin

You must also have SSO turned on in Klaviyo before you set up SCIM.

Note that SCIM provisioning is often an add-on for identity providers (IdPs). For instance, IdPs often require a separate SCIM plan in addition to an SSO plan. If you don't see the following steps in your IdP, please confirm you have the correct plan.

For each user, your IdP must send a role and an email address as userName. The username must match an email value sent for that user.

For a portfolio, use portfolio_admin, portfolio_manager, or portfolio_analyst. Account roles such as admin don't apply to portfolios. SCIM can't create users with the Owner or Portfolio Owner role.

Klaviyo supports provisioning users, not group objects. You can assign an IdP group to select users for provisioning, but leave group provisioning turned off.

Turn on SCIM user provisioning

Click your organization name in the lower left corner.
Click Settings > Security.

Check the SCIM Provisioning box.
Click Copy or Download (.txt) to save the access key as shown. This key is only shown once, so store it somewhere secure before closing the dialog.

Click Done.
Copy the base URL and paste it somewhere, preferably where you stored the access key.

Replacing a SCIM access key immediately invalidates the previous key. If you lose your key, click Replace SCIM key, then Confirm. Save the new key and update it in your IdP.

Next, go to your identity provider to finish the process. Below are instructions for Okta, OneLogin, and Microsoft Entra ID. Other providers must support compatible SCIM 2.0 user provisioning.

Okta

For current setup navigation, see Okta’s SCIM setup guide. Use the Klaviyo connection settings below.

Navigate to Application > Applications.
Select the Klaviyo app.
Go to the Sign On tab.

Under Credential Details, check that:
Application username format is set to Email.
Update application username on is set to Create and update.

Click into the General tab.

Select Edit.
Under Provisioning, select SCIM.

Click Save.
Click into the Provisioning tab.
Select Edit to open the SCIM Connection page (shown below).

In SCIM connector base URL, paste the base URL from Klaviyo.
For Unique identifier field for users, enter userName.
Under Supported provisioning actions, check the following boxes:
Import New Users and Profile Updates
Push New Users
Push Profile Update
Change the Authentication Mode option to HTTP Header.
Paste in the access key under Authorization.

Click Test Connector Configuration.
Click Save.
Next to Provisioning to App, click Edit.
Check Enable for the following features:
Create Users.
Update User Attribute.
Deactivate Users.

Click Save.
Scroll down to your app’s attribute mappings section.
Click Go to Profile Editor.
Click Add Attribute.

Type “role” for Display name, Variable name, and External name.
In External namespace, enter the following: urn:ietf:params:scim:schemas:core:2.0:User
Check the box for Define enumerated list of values.

For an account, add the standard role values below. For a portfolio, use portfolio_admin, portfolio_manager, and portfolio_analyst instead.
admin
manager
analyst
campaign_coordinator
content_creator
social_media_manager
support

Scroll down to Attribute required and check Yes.
Choose the attribute type (personal or group).
Recommended: leave the User permission as Read Only.

Click Save.
Navigate to Applications > Applications and then select your app.
Click Assign.
Choose whether to assign the app to an individual (i.e., people) or to a group.

Find the people or groups you want to assign Klaviyo to, and click Assign next to their name(s).

Scroll down to the role field and assign them the correct role.

Click Save and go back.

OneLogin

In the Admin Portal, click Applications.
Click Add App.
Search “Klaviyo.”
Click Klaviyo to add it.
Optional: Rename the connection.
Click Configuration.
In the SCIM Bearer Token field, paste your SCIM access key.
Click Enable under API Connection.
Click Save.
Go to Provisioning in the left sidebar.
Check the Enable Provisioning box.
Do not uncheck the Create user, Delete user, or Update user boxes.

Recommended: select Delete in the dropdown for When users are deleted in OneLogin, or the user's app access is removed, perform the below action.
Click Save.

Microsoft Entra ID (formerly Azure AD)

For current setup navigation, see Microsoft’s SCIM provisioning guide. Use the Klaviyo URL, access key, and mappings below.

Log into Microsoft Entra ID.
Click Microsoft Entra ID (formerly called “Azure Active Directory”)
Click Enterprise Applications on the left side.

Select your application.
If you haven’t created your application yet, follow the steps in the SSO guide.
Click Provisioning on the left, then select Get Started.

In the field named Provisioning Mode, select Automatic.

Go to the Admin Credentials.
Paste the SCIM base URL from Klaviyo into the Tenant URL field.
Paste the SCIM API key into the Secret Token field. Note that this token should be pasted in without any prefixes (e.g., don’t include “Bearer” or “Klaviyo-API-Key”).
Test the connection.
Once the connection is successful, click Save in the upper left.
In that same page, scroll down and open the Mappings dropdown.

Select Provision Azure Active Directory Users.
Optional: delete unsupported mappings. Klaviyo supports the following target attributes for user updates:
userName
active
emails[type eq “work”].value
name.givenName
name.familyName
emails[primary eq “True”].value
roles[primary eq “True”].value
To map an assigned app role, use SingleAppRoleAssignment([appRoleAssignments]) as an Expression mapping to roles[primary eq “True”].value.
Don't map appRoleAssignments directly to Klaviyo.
Assign 1 app role per user and scope provisioning to assigned users and groups. This expression does not support syncing all users and groups. See Microsoft’s role-mapping guidance.
Click Save and then click Home.
Navigate back to Microsoft Entra ID > Enterprise applications > Klaviyo > Provisioning.
Select Start Provisioning.

Now, Microsoft Entra ID will begin provisioning your users on a schedule. For more insight into which users it has provisioned, select View provisioning logs.

Additional resources

How to set up single sign-on (SSO)

Learn how to set up single sign-on (SSO) for your Klaviyo account or portfolio. Currently, only identity provided (IdP) single sign-on is supported in Klaviyo. - Troubleshoot SSO and SCIM errors

Learn how to troubleshoot errors for single sign-on (SSO) with Klaviyo. This article is meant for those familiar with SSO, such as IT professionals. - How Klaviyo billing works

Learn how Klaviyo bills customers for Profiles and Emails, Mobile Messaging, Reviews, Advanced Klaviyo Data Platform (formerly “CDP”), Marketing Analytics, Customer Hub, Helpdesk, and Customer Agent.

Was this article helpful?

YesNo

Use this form only for article feedback. Learn how to contact support.