Send group data to LearnUpon over SCIM
Set up SCIM group push to send group membership to LearnUpon through your identity provider (IdP). Changes in your IdP data use SCIM to update LearnUpon when an admin adds learners to, or removes learners from, the group.
Availability: all customers
Customers who use identity providers such as Okta, Microsoft Entra ID (Azure AD), and OneLogin can provision users automatically over SCIM 2.0.
You can also share group membership through the identity provider, so admins don't need to manage LearnUpon group membership manually.
LearnUpon treats the IdP as the source of truth, and applies changes to the learner's account automatically.
Currently, this provisioning works in one direction. You create or update accounts and groups in the identity provider, and SCIM creates or updates the same details for learners in LearnUpon.
Tip: provisioning through an IdP takes time. How long it takes depends on the number of your accounts, and the depth of your custom user data, and your IdP’s own schedule.
IdP + SCIM compared to using SAML
When using SAML (Security Assertion Markup Language) to provision LearnUpon: SAML sends a single large event with the complete state of the user, including user info, custom data, group memberships in a single request.
SCIM (System for Cross-domain Identity Management) sends multiple requests and can update a single piece of data in the request.
In this context, the SCIM group push receives group membership data from the IdP, and adds it to existing learners and their profiles in LearnUpon.
Note: SCIM group sync is built for steady, incremental changes rather than a one-off bulk load.
If you manage thousands of groups, SAML group sync is the best tool to use. The SAML group sync updates a learner's groups at user login and has no batch ceiling.
Sample uses for group provisioning
Group syncing doesn’t create, edit or delete learners. It moves them in and out of groups, and thus can change the enrollments based on group membership.
Some examples of automated group management through SCIM 2.0:
- enroll a learner into a LearnUpon group's courses and learning paths as soon as your IdP adds them to the matching group
- remove a learner's group-driven enrollments automatically when your IdP removes them from the group
- set a group's exact membership from your IdP's source of truth, without an admin reconciling the list by hand
Consult your IdP's complete documentation for full guidance on setting up group syncing.
Two switches, not one
This feature has 2 switches:
- turning on group sync for the portal through the portal settings
- turning on Sync group with SAML SSO for the relevant groups
See Create groups, and assign users to groups
Only groups with Sync group with SAML SSO on are visible to your IdP. A group without this setting turned on doesn't appear in listings. If you try to change a membership for a group without a group sync setting, LearnUpon returns a not found error.
SCIM 2.0 group sync does not create groups on your behalf. You first create and name your groups in LearnUpon before your IdP can populate them with user data.
The one-time setup in your portal is the same for all IdPs.
Adding a learner to a sync’ed group through the IdP
LearnUpon:
- enrolls them in the courses and learning paths assigned to that group
- clears any pending group invites already sent to them for that group
- updates group-based rules and reporting update
Removing a learner from a sync’ed group through the IdP
LearnUpon:
- removes the enrollments and learning path assignments they received through that group
- records the removal in the audit trail, attributed to SCIM as the source, so you can tell a SCIM removal from a manual one
Any enrollments the learner received directly, outside the group, don’t change.
Note: Only removals appear in the audit trail.
There's no audit-trail entry for adding a learner to a group, from SCIM 2.0 or from other manual sources like self-registration or batch upload. LearnUpon records adding a learner through the group's membership and through reports.
Notes about group provisioning with your IdP
Using your IdP to manage group membership can change a lot of enrollments and unenrollments.
LearnUpon recommends testing the feature with a single small group, before setting up multiple groups for provisioning through the IdP, with the following notes:
- members are identified by their LearnUpon user ID, not by email or username. Your IdP learns these IDs from user provisioning, so users must be provisioned before their groups can sync
- group name search supports one form only: displayName eq "Group Name". Anything more complex is rejected
Access permissions
- admins with full portal permissions: can turn on group sync for the portal, and mark individual groups as synced
SCIM 2.0 is available in sub-level portals. You set up SCIM 2.0 group sync separately for each portal. A group in one portal isn't visible to another portal's SCIM connection.
See Create groups, and assign users to groups
Prerequisites
To use SCIM 2.0 group sync you need:
- SCIM 2.0 user provisioning already set up and working in your portal
- The groups you want to sync already created in LearnUpon
- An IdP that is compatible with SCIM 2.0, using its standard group-push configuration
See:
- Portal: set up SCIM 2.0 with basic authentication
- Portal: set up SCIM 2.0 with bearer-token authentication
- Create groups, and assign users to groups
- Your IdP’s documentation about group syncing
Note: Users must exist in LearnUpon before they can be added to a group.
If your IdP pushes a group before it has provisioned the users in it, the unknown members are skipped rather than causing an error. The unknown group members are picked up automatically on the next sync, once they exist as users.
One-time setup of SCIM 2.0 group sync
- From main navigation go to Settings > Integrations > SAML SSO.
- Select SCIM settings.
- From Group settings select Enable group synchronization.
- Save to finish.
Add groups to the synchronization
See Create groups, and assign users to groups > Add SAML synchronization to a group.