• Prerequisites
• Setup Instructions
• Team Provisioning
• Important Notes
• Troubleshooting

Overview

SCIM (System for Cross-domain Identity Management) automates user and team provisioning in Read AI workspaces through identity provider integration. This enables IT teams to centrally manage access, reduce manual work, and maintain compliance.

Supported IdPs: Microsoft Entra (formerly Azure AD), Okta, and Google Workspace are currently the only officially supported platforms. Contact support to request additional providers.

SCIM capabilities include:

• Creating new users: Automatically creates accounts for users assigned to Read AI in your IdP, adds them to the workspace, and sends onboarding email. The IdP manages these users going forward.
• Updating existing users: Transitions current Read AI account holders to IdP management, enabling automatic attribute updates and deactivation control through your identity provider.
• Provisioning teams: Creates Read AI teams from your IdP groups and keeps their membership in sync. Existing teams whose names match a group become IdP-managed. Currently available for Microsoft Entra only.

Important: SCIM provisioning does not control sign-in methods. Many organizations also configure SAML single sign-on separately.

Prerequisites

• You must be a workspace admin in Read AI.
• Your workspace must be on the Enterprise+ plan.
• You must verify the domain(s) for any users you want to provision with SCIM (unless they are already in your workspace).
• You need admin access to your Microsoft Entra tenant, Okta organization, or Google Workspace account.

Setup Instructions

The setup process varies slightly depending on which IdP you use. For step-by-step instructions with screenshots, see:

• For Microsoft Entra: SCIM Setup with Client Credentials
• For Okta: SCIM Setup with Authorization Code
• For Google Workspace: SCIM Setup with Google Workspace Directory Sync

Please make sure to follow the instructions carefully, as a misconfiguration may prevent the integration from working or result in unexpected provisioning behavior.

Team Provisioning

Team provisioning is optional and is configured in your identity provider, not in Read AI. Once it's on, the groups you provision become teams.

The first time a group is provisioned, workspace admins receive a one-time email confirming that team provisioning has started.

Which groups become teams

Every group you provision becomes a team in Read AI, named after the group.

• If no team with that name exists, a new team is created. This is the most common case.
• If a team with that name already exists, that team becomes IdP-managed and its membership is replaced by the group's.

Group names are matched to team names exactly, ignoring case. Renaming a group in your identity provider renames the corresponding team in Read AI. The team, its history and its settings are preserved.

Teams provisioned by SCIM are labeled IdP-Managed throughout Read AI.

What you can and can't change

Removing a team from provisioning

Unassigning a group from provisioning deletes its team in Read AI. This is standard SCIM behavior; your identity provider is the source of truth, so removing a group there removes the team here.

Before unassigning a group, note what deleting the team affects: meeting reports shared with that team lose that sharing. Recreating a team with the same name doesn't restore it — those reports would need to be shared with the new team again, one at a time. Team-level metrics and trends are also lost, and any team-specific settings stop being enforced.

To stop syncing a team without deleting it, turn off group provisioning in your identity provider rather than unassigning the group. Existing teams stay in place and stop receiving updates, but they remain IdP-managed (you still won't be able to change their membership in Read AI).

To return teams to manual management, disable SCIM provisioning in your Read AI workspace settings. All teams and users stop being IdP-managed and can be edited normally in Read AI. Note that this ends user provisioning as well.

Team roles and managers

Your identity provider controls who is on a team. Read AI controls what they can do.

Everyone added by provisioning joins as a User, and you can promote someone to Manager at any time. Because roles aren't provisioned, a newly created team starts without a manager, and Read AI shows a reminder on teams that don't have one.

Managers can configure team-specific settings for the teams they manage, while regular users cannot. Workspace owners and admins can also configure team-specific settings for any team in their workspace.

Teams you create yourself

You can still create and manage your own teams alongside provisioned ones. Two things to know:

• Read AI won't let you create a team with the same name as a team that already exists in your workspace.
• If a group with the same name is later provisioned, your team will become IdP-managed at the next sync. Its membership will be replaced by the group's, and you'll no longer be able to change its membership in Read AI.

Because groups sync on a delay, this can happen shortly after you create a team if the group already existed in your identity provider but hadn't synced yet. If you're using team provisioning, it's worth checking your groups before creating a team by hand.

Important Notes

• SCIM-provisioned users cannot be manually deleted or removed from the workspace; deprovisioning must be managed via your IdP.
• Team provisioning controls team membership, naming, and deletion. It doesn't affect team roles, settings, or permissions.
• If auto-charge is enabled, additional licenses are purchased automatically when new users are provisioned, up to whatever maximum is configured. If disabled, provisioning will fail when there are not enough available licenses.
• Deprovisioned users are deactivated and their seat is freed automatically. Licenses won't ever be automatically removed, if you want to decrease your total licenses, you will need to do so from the manage billing page.
• Client secrets do not expire, but can be rotated from your Read AI workspace settings if needed.

Troubleshooting

• If you encounter any issues, double check that you followed the setup instructions correctly. The attribute mapping process in particular can be error-prone.
• Errors during provisioning are surfaced in your IdP, but Read AI will also notify workspace admins via email. Common errors include:
  • Insufficient licenses:
    • You have no unused licenses in your workspace, and auto-charge is either disabled, or your limit has been reached.
    • To fix, either purchase more licenses manually, enable auto-charge, or increase your auto-charge seat limit.
  • User is in another workspace:
    • The user you are trying to provision already has a Read AI account and belongs to a different workspace. Provisioning will fail until they leave the other workspace.
    • To fix, either have the user leave their other workspace, or unassign them from your application in your IdP.
  • User's email is unverified:
    • Someone has created an account with the email address of a user assigned to your IdP application, but has not verified their email address. Such users cannot be transitioned to being IdP-managed or added to your workspace, and provisoning will fail.
    • To fix, either have the user verify their email address, or unassign them from your application in your IdP.
  • User is a workspace owner or admin:
    • While provisioned users can be workspace owners or admins, you cannot deactivate an owner or admin via SCIM.
    • To fix, unassign the user from your IdP application so you can manage them manually in the Read AI workspace settings.
• If you enable team provisioning, you may encounter the following:
  • A team disappeared. The group was unassigned from your application in your identity provider, which deletes the corresponding team in Read AI. Re-assigning the group creates the team again with its current members, but it will be a new team (meeting reports shared with the previous one will need to be shared again).
  • A team I expected isn't in Read AI. Check that the group is provisioned in your identity provider and that a sync cycle has completed.
  • A team has the wrong members. Membership comes from the group — change it in your identity provider.
  • I can't remove someone from a team. If the team is labeled IdP-Managed, remove them from the group in your identity provider instead.
  • A team I created is now labeled IdP-Managed. A group with the same name was provisioned, so Read AI took it over at the next sync.
• Remember that you must verify domain ownership in order to provision new users or existing users outside of your workspace.