Set up SAML SSO and SCIM provisioning
Let your team sign in through your identity provider and keep the roster synced with SCIM 2.0.
What this covers
This article is about signing in to Cubbie itself with your identity provider, and auto-provisioning your team. Reading app-usage data out of your identity provider is a different feature — see the identity provider connector article for that.
Set up SAML SSO
From Buyer → SSO, add a SAML provider for your buyer organization. It works with Okta, Microsoft Entra, Google Workspace, OneLogin, Auth0, JumpCloud, and most other SAML 2.0 identity providers.
1. Create a SAML app in your identity provider.
2. In Cubbie, add a provider and enter the values from your IdP: entity ID, SSO URL, the signing certificate (PEM), and optionally a single-logout URL.
3. Copy the values Cubbie shows back into your IdP app configuration.
4. Test with one user before rolling out broadly.
Each provider has a default role — the access level newly provisioned users receive — so people land with sensible permissions on day one.
Turn on SCIM provisioning
Once SSO is connected, SCIM 2.0 keeps your roster in sync automatically: joiners get accounts, leavers lose access, and there is no manual cleanup.
- SCIM base URL:
https://cubbie.com/api/auth/scim/v2 - Point your IdP provisioning integration at that base URL with the SCIM details shown on the SSO page
Good to know
- SSO and SCIM apply to a buyer organization, so set up your buyer org first.
- Providers can be activated and deactivated; deactivating stops SSO logins through that provider without deleting its configuration.
Rollout checklist
1. Configure the provider and test with one account.
2. Enable SCIM and confirm a test user provisions with the default role.
3. Announce the change, then watch the first week for login issues.