Sonar supports SCIM 2.0 provisioning, letting your IT team manage Sonar staff accounts from your identity provider (Okta, Microsoft Entra ID, SailPoint, and others) instead of by hand in Settings → Users.
Note: this integration is enabled by the Sonar team for your company — please contact [email protected] to request it to be turned on.
What SCIM provisioning does
Create Sonar staff accounts from your identity provider, including their Sonar role, NMLS ID, and branch
Update those details when they change in your directory
Deactivate a user the moment they're deprovisioned — their Sonar access ends with their directory account
Manage permission group membership, so access follows your directory's group assignments
SCIM manages your internal (staff) users only — borrower accounts are not affected. Users created or updated through SCIM appear in Settings → Users like any other user.
How to set it up
Once the Sonar team has enabled SCIM for your company, go to Settings → Integrations and add a new integration with type SCIM Provisioning. This is a company-level connection — one active connection per company.
Enter a Bearer Token. This is the secret your identity provider will present on every provisioning request — generate a strong value and treat it like a password.
Copy the SCIM Base URL shown on the connection (it's read-only — click to copy).
In your identity provider's SCIM configuration, paste the SCIM Base URL and the same Bearer Token, then assign the users and groups you want provisioned into Sonar.
Save the connection in Sonar and run a test sync from your identity provider to confirm users appear in Settings → Users.
FAQs
Which identity providers are supported?
Any provider that speaks standard SCIM 2.0 — including Okta, Microsoft Entra ID, and SailPoint.
Can I still manage users manually?
Yes. SCIM runs alongside manual administration — admins can still create and edit users in Settings → Users.
What happens if I rotate the Bearer Token?
Update the token in both places — the Sonar connection and your identity provider — or provisioning requests will be rejected until they match.