SCIM v2 & v3 Differences

To support cross-domain identity management for SCIM User Provisioning, OneTrust has offered two iterations for SCIM integrations: Legacy SCIM Integration (SCIM v2) and Enhanced SCIM Integration (SCIM v3). The following sections provide information on the differences to help your organization determine which iteration is best suited for your needs.

Background

In OneTrust's Legacy SCIM Integration (SCIM v2), only User Provisioning was supported. In OneTrust 6.29, OneTrust introduced the enhanced SCIM Integration (SCIM v3) which supported both User Provisioning and Group Provisioning. With Group Provisioning, Site Admins can manage access for users in bulk by provisioning them to one or more user groups.

Differences between SCIM v2 & v3

Legacy SCIM Integration (SCIM v2)

OneTrust's Legacy SCIM Integration (SCIM v2) leverages the Organization and Role attributes to describe subsets of users. Each OneTrust user will fall into a "group" that is a combination of both an organization and an assigned role.

The following diagram illustrates the flow between your identity provider (IdP) and the OneTrust Platform when utilizing the Legacy SCIM Integration (SCIM v2).



  • Supports only User Provisioning.

  • Provisions users with a role + organization combination instead of defining access policies as part of a OneTrust user group.

  • Results in a "group" created in your IdP for each unique OneTrust role + organization combination.

Note:

For more information, see Legacy SCIM User Provisioning.

Enhanced SCIM Integration (SCIM v3)

The enhanced SCIM Integration (SCIM v3) aligns with the general SCIM standard by leveraging the ability to preset and configure access policies (1 to many) as part of a OneTrust user group. Users would then be provisioned with the roles and organization access defined for each user group to which they are assigned.

The following diagram illustrates the flow between your IdP and the OneTrust Platform when utilizing the Enhanced SCIM Integration (SCIM v3).



  • Supports both User Provisioning and Group Provisioning.

  • Bulk provisions a group of users with the appropriate roles and organizations by defining access policies as part of a OneTrust user group.

  • Results in a more streamlined list of groups within your IdP that aligns with your OneTrust user groups, simplifying the process for sending or assigning work to groups of people in the OneTrust Platform.

Note:

For more information, see SCIM User & Group Provisioning.

SCIM FAQ

The following responses are supported solutions to frequently asked questions (FAQ) on SCIM. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.

Does everyone have access to both the Legacy SCIM Integration (SCIM v2) and Enhanced SCIM Integration (SCIM v3)?

Only existing accounts that enabled Legacy SCIM User Provisioning prior to OneTrust 6.29 have access to SCIM v2. Accounts created after OneTrust 6.29 will automatically utilize SCIM v3.

If I already implemented the Legacy SCIM Integration (SCIM v2), do I need to move to the Enhanced SCIM Integration (SCIM v3)?

The Enhanced SCIM Integration (SCIM v3) offers the primary benefit of having a list of groups within your IdP that are identical to the list of user groups within the OneTrust Platform. If your organization does not need an identical list of groups that is currently maintained in your IdP, there is no need to move to SCIM v3.