← Cloudflare One / cloudflare-one / insights / logs / dashboard-logs

SCIM provisioning logs

SCIM (System for Cross-domain Identity Management) activity logs allow administrators to audit how SCIM provisioning events in an identity provider (such as create, update, and delete) affect a user's identity and group membership in Zero Trust. You can compare your Zero Trust SCIM logs with your identity provider's SCIM logs to track how identity data is shared between the two services and pinpoint the source of any provisioning errors.

View SCIM logs

For an overview of SCIM events across all users, log in to the Cloudflare dashboard ↗ and go to Zero Trust > Insights > Logs > SCIM provisioning logs. This page lists the inbound SCIM requests that your identity providers have sent to Cloudflare. You can select an individual request to view more details about the SCIM operation.

To investigate how SCIM events impacted a specific user, go to their User Registry identity. View their last seen identity and group memberships, and track how their identity has changed over time.

Log fields

SCIM provisioning logs show the following information for each inbound SCIM request:

IdP name: Name of the identity provider that sent the request
Timestamp: Date and time of the request
Action: HTTP request method (POST, PUT, PATCH, DELETE). POST indicates a resource was created, PUT indicates a full resource replacement, PATCH indicates a partial update, and DELETE indicates a resource was removed.
User email: User who received the SCIM identity update
Group name: Group that received the SCIM identity update
Resource type: Whether the request modified a group or a user (GROUP or USER)
CF resource ID: Persistent identifier for the user or group created by Cloudflare SCIM. Use this ID to look up the resource in Zero Trust.
IDP resource ID: Identifier for the user or group provided by the identity provider. Use this ID to match the log entry with the corresponding record in your identity provider.
Outcome: Whether the SCIM request was applied successfully (SUCCESS or ERROR)
Request body: HTTP request body containing the data that was added, modified, or removed
JSON log: SCIM request log in JSON format