Automatic Provisioning

Automatic provisioning lets your identity provider keep Kamo up to date on its own. Someone added in your provider appears in Kamo, a change to their job title or department follows them, and someone removed in your provider is terminated in Kamo. The standard behind it is called SCIM.

Automatic Provisioning

Open Settings, then Security, choose Identity & Sign-In, then Provisioning. You need the Manage Identity Providers permission. Provisioning works through an identity provider connection, so add one first (see Identity Providers). If you have several, pick one at the top.

Provisioning only works while that connection is turned on.

Turn Provisioning On Or Off

• On: Kamo makes a token. Your provider uses it, with the provisioning address, to add, update and remove people.
• Off: every token for this connection stops working at once. Nobody already in Kamo is changed.
• Example: turn it on, paste the address and the token into Okta, and from then on a new hire added in Okta appears in Kamo within minutes.

The Provisioning Address

The address your provider sends its changes to. Copy it into your provider's provisioning settings, where it may be called the Tenant URL, the SCIM connector base URL or the Base URL.

Tokens

A token is the password your provider uses to make changes. It is shown once, when it is made: copy it straight away. If it is lost, make a new one.

• Make A New Token makes another, for example to replace an old one without a gap. A connection can have up to five working tokens.
• Each token shows who made it and when, and when it was Last Used.

Revoke A Token

Revoke stops a token working for good. If it is the one your provider is using, provisioning stops until you paste a new one.

When Someone Is Removed

When your provider removes someone, or switches them off, Kamo always terminates them. It never deletes anyone.

• Their membership is terminated, the same as pressing Terminate on their profile.
• They are signed out everywhere at once.
• KamoMobile on their phone is disconnected.
• Apps they connected with their account, such as voice assistants, are disconnected.
• Their history, notes and records stay, and you can activate them again later.
• Owners can't be removed this way.

What Provisioning Changes

• Adds new people as team members, with a verified work email.
• Keeps their work email, job title and department up to date.
• Groups in your provider become teams in Kamo, with the same members.
• It never changes the name on someone's own Kamo account.

Recent Activity

When your provider last called, and the people it removed lately, newest first. Removals are read from the access log, so you need to be able to view access logs to see them listed.

Where To Paste It

Each provider keeps provisioning in a different place; the page shows short steps for yours.

• Microsoft Entra ID: Enterprise applications, your app, Provisioning, Automatic. The address is the Tenant URL and the token the Secret Token.
• Okta: set Provisioning to SCIM on the app's General tab, then on the Provisioning tab paste the address as the SCIM connector base URL, use userName as the unique identifier, and choose HTTP Header with the token.
• JumpCloud, OneLogin, Ping Identity: look for SCIM 2.0 or SCIM Outbound, paste the address and the token, and test the connection.
• Google Workspace only provisions to apps in its own catalogue, so use New People on the identity provider instead: people are added the first time they sign in.