How to configure SCIM with OneLogin

You can use System for Cross-domain Identity Management (SCIM) provisioning to manage Calendly users from OneLogin — an Identity Provider (IdP) that manages your organization's user credentials. With SCIM, you can:

• Create users
• Update user attributes (like name and email)
• Deactivate and delete users

Changes in OneLogin will automatically sync to Calendly. SCIM is only available on the Enterprise plan. Contact your Account Executive or Calendly Sales to learn more.

Before you begin

Make sure you meet these requirements before you set up SCIM:

• You must configure and enforce Security Assertion Markup Language Single Sign-On (SAML SSO) — the authentication standard that lets users sign in to Calendly through your IdP.
• You must be a Calendly Owner or Admin.
• Open Calendly in one browser window and OneLogin in another for easier setup.

Enable SCIM provisioning

1. In Calendly, go to Account > Organization Settings > Single sign-on.
2. Under Optional: Connect SCIM, toggle on SCIM provisioning.

Add details to OneLogin

1. In OneLogin, go to Applications > Applications.
2. Search for the Calendly app and select it.
3. In the left menu, select Configuration.
4. In Calendly, select Copy Base URL. In OneLogin, paste the Base URL into the SCIM Base URL field.
5. In Calendly, select how long the bearer token should last. (A bearer token is a credential that authorizes OneLogin to make SCIM requests to Calendly on your behalf.)
6. Select Generate new bearer token.
7. In Calendly, select Copy token and paste the bearer token into OneLogin in the SCIM Bearer Token field.
8. In OneLogin, select Enable.
9. Select Save.

Add parameters in OneLogin

1. In OneLogin, go to the Parameters tab.
2. Select SCIM Username.
3. Set Value to Email.
4. Select Save.

Enable provisioning in OneLogin

1. In OneLogin, go to Provisioning.
2. Under Workflow, select Enable provisioning.
3. Under Require admin approval before this action is performed, choose the appropriate values for each action:
• Create user:
• If the Create user approval box is selected, admins must approve new users before those users can log in.
• If the Create user approval box is not selected, users are created automatically when they are assigned the Calendly application.
• In either case, users will get an invite email to join Calendly and must accept the invite before logging in.
• Delete user: You must approve deletion. ⚠️ Because deleting a user is a non-reversible action, you should require admin approval and keep the Delete user approval box checked.
• Update user: You must approve any updates made in OneLogin.
4. Under When users are deleted in OneLogin, or the user's app access is removed, perform the below action, select Suspend.

⚠️ Note on Suspend vs. Delete deprovisioning: While Calendly supports delete-based deprovisioning, choose the Delete action with caution. The Suspend action deactivates the Calendly user account and revokes access, but preserves the user's data so the account can be reactivated later. The Delete action permanently removes the user's Calendly account and all their data, and is non-reversible.

1. Select Save.

Approve users

1. In OneLogin, go to Applications > Calendly > Users.
2. Check that the correct Calendly users are listed.
3. To approve all users, select Bulk approve X pending logins for the same app, then select Approve. Alternatively, you can individually approve each pending user. If you do not approve a user, that user won't be able to log in to Calendly.
4. If some users are not Pending, select Apply to all, then Reapply Mappings.

Note: To check the SCIM provisioning logs, go to Users > Provisioning. Under All Apps, select Calendly.

Assigning groups in Calendly

For larger organizations, managing group membership in Calendly may require some level of automation. Group assignment can be achieved through SCIM by mapping existing user-profile attributes from OneLogin to Calendly groups. Read more in our guide on how to use groups in Calendly.

OneLogin does not currently support custom attributes for catalog applications — the pre-built Calendly app available in OneLogin's Applications catalog. An update request has been made to OneLogin to support the custom attribute needed for group mapping. In the meantime, OneLogin does support a standalone SCIM application — a generic SCIM connector that you configure manually, separate from the pre-built catalog Calendly app — which does support custom attributes. To use the standalone SCIM application, follow our Generic SCIM documentation on how to configure the standalone SCIM application.