Reference Glossary
SCIM provisioning
An IETF REST protocol (RFC 7643/7644) that automates creating, updating, and deactivating user accounts across systems from a central identity source.
Why it matters in a DAM
In a DAM, SCIM is what actually removes someone's access the moment they're offboarded in HR or the identity provider, rather than relying on an admin remembering to delete the account manually. It also handles the reverse case cleanly: a new hire added to the 'Marketing' group in the identity provider gets a DAM account with the right role provisioned automatically, without an IT ticket. Without SCIM, DAM admins end up doing quarterly access reviews by hand, and departed contractors or agency staff commonly retain live download access to brand assets for months.
A worked example
Common mistake
Buying a DAM plan or tier that includes SAML login but not SCIM, then assuming account deprovisioning is automatic — it isn't unless SCIM (or an equivalent provisioning API) is explicitly enabled and mapped.
SCIM (System for Cross-domain Identity Management) is defined by two IETF standards: RFC 7643, which specifies the core schema for User and Group resources, and RFC 7644, which specifies the REST protocol — endpoints, filtering, and PATCH semantics — for creating, reading, updating, and deleting those resources. In practice, it’s the plumbing that keeps user accounts in sync between a central identity provider and every downstream application, including a DAM.
SCIM and SAML solve different problems and are frequently bundled together but sold or licensed separately. SAML handles the moment of login: proving who someone is. SCIM handles the account lifecycle around that: making sure the account exists with correct attributes before login is even attempted, and making sure it’s disabled the moment the person leaves. A DAM with SAML but no SCIM still requires manual account creation and, critically, manual deactivation — the gap most likely to leave a former employee or agency partner with lingering access to licensed or unreleased assets.
For DAM buyers evaluating vendors, SCIM support is worth confirming at the specific pricing tier being purchased, not just ‘the platform’ in general — many DAM vendors gate SCIM behind an enterprise plan while offering SAML more broadly.
Frequently asked
What does SCIM provisioning actually automate in a DAM?
SCIM automates creating, updating, and deactivating DAM user accounts from a central identity source. It's what removes someone's access the moment they're offboarded in HR or the identity provider, rather than relying on an admin to delete the account manually.
What standards define SCIM?
SCIM (System for Cross-domain Identity Management) is defined by two IETF standards: RFC 7643, covering the core User and Group schema, and RFC 7644, covering the REST protocol -- endpoints, filtering, and PATCH semantics.
How is SCIM different from SAML?
SAML handles the moment of login -- proving who someone is. SCIM handles the account lifecycle around that: making sure the account exists with the right attributes before login and disabling it the moment the person leaves. A DAM can support one without the other.
What happens if a DAM has SAML but not SCIM?
Account creation and deactivation stay manual. That gap is exactly where a former employee or agency partner can keep lingering access to licensed or unreleased assets for months, since nobody automatically revokes it.
Is SCIM support guaranteed at every pricing tier of a DAM?
No -- many DAM vendors gate SCIM behind an enterprise plan while offering SAML more broadly. Buyers should confirm SCIM is included at the specific tier they're purchasing, not assume it comes with "SSO support" generally.
What's a concrete example of SCIM working correctly?
A new hire added to the "Marketing" group in the identity provider gets a DAM account with the right role provisioned automatically, without an IT ticket -- and when that same person leaves, the account is disabled the same day without manual intervention.
Sources
- SCIM 2.0 is defined by RFC 7643 (core schema for User and Group resources) and RFC 7644 (protocol, including endpoints, filtering, and PATCH semantics). checked 2026-08-07 — IETF Datatracker, RFC 7643