Supported Identity Providers
MoEngage supports SCIM provisioning with any Identity Provider (IdP) that follows the SCIM 2.0 protocol. Okta, Azure (Microsoft Entra ID), and JumpCloud are documented with step-by-step guides because most MoEngage customers use these IdPs, not because MoEngage limits SCIM support to them. If you use a different SCIM 2.0-compliant IdP, follow your IdP’s documentation to configure the SCIM base URL and bearer token generated from your MoEngage workspace. For details on generating this token, refer to Configure SCIM in MoEngage.Problem
Provisioning fails, or user or role updates from your IdP don’t sync to MoEngage.Explanation
SCIM sync errors surface in your IdP’s admin console, not in MoEngage, since your IdP is the system that initiates and reports the sync operation.Set up Single Sign-On (SSO) for your MoEngage workspace before you configure SCIM. MoEngage requires a working SSO configuration as a prerequisite for SCIM.
Solution
- Check your IdP’s admin console for the specific sync error message and details.
- Share the exact error message from your IdP with the MoEngage Support team so they can investigate the sync failure.
JumpCloud-Specific Issues
Provisioning fails when group management is enabled
Provisioning fails when group management is enabled
JumpCloud currently creates SCIM groups without any user members, which the MoEngage API rejects. Leave the Enable management of User Groups and Group Membership in this application toggle disabled on the Provisioning tab, and assign roles at the individual user level instead. For steps, refer to Map the Role Attribute.
Role updates don't reflect in MoEngage
Role updates don't reflect in MoEngage
Confirm the destination attribute in JumpCloud’s Export Attribute Mapping uses a period before role, not a colon:
urn:ietf:params:scim:schemas:extension:moengage:2.0:User.role. JumpCloud reads role as a property of the moengage:2.0:User extension, unlike the colon-separated syntax used for Okta and Azure.