Setup SCIM with OneLogin – 15Five Help Center

Streamline your employee onboarding and data management by connecting OneLogin with 15Five using SCIM (System for Cross-domain Identity Management).

This integration automatically creates, updates, and deactivates people in 15Five based on changes made in OneLogin—keeping your data accurate and up to date without the need for manual updates.

What you’ll find in this article:

Integration capabilities
How to set up SCIM with OneLogin
Syncing
Start Dates for delaying invites
Syncing groups
How to disconnect
Troubleshooting and FAQs

Access and availability

⛔️ Required access to Manage integrations.
👥 This article is relevant to Account admins.
📦 This feature is available in all pricing packages.

✏️

Note

Most organizations enable both Single Sign-On (SSO) and SCIM. If you’re planning to use both, set up SSO before you configure SCIM. SSO will pass only Email and Name ID; all other attributes will be managed by SCIM.
👉 Learn how to set up SSO

Integration capabilities

The 15Five <> OneLogin integration allows you to automatically provision users and user data, including:

Add new people to 15Five. New people created through OneLogin will also be created in 15Five.
Update select fields in people’s profile information in 15Five. Updates made to the individual's profile through OneLogin will be pushed to 15Five.
Deactivate people in 15Five. Deactivating the individual or disabling the individual's access to the application through OneLogin will deactivate the person in 15Five.
Import new people. New individuals created in the third-party application will be downloaded and turned into new AppUser objects, for matching against existing OneLogin users.

How to set up SCIM with OneLogin

💡

Tip

If you want to use 15Five’s start date functionality, and the hire/start date in OneLogin is not the date you want the employee to get access to 15Five (e.g. in the past), it is recommended that you first do a bulk import to bring all of your employees to 15Five and turn off the ‘Start date’ option in 15Five’s SCIM settings. Since 15Five syncs the hire date from OneLogin, and can not accept a past Start date, this would be the best way to onboard your existing employees.

Set up SCIM with OneLogin

If you plan to use SSO, set it up prior to continuing.
Click the Settings gear in the top, right-hand corner of 15Five.
Select 'Integrations' from the dropdown menu.
Click on Enable to the right of the SCIM 2.0 option.
Check the box next to "Enabled" and Save.
Click Generate OAuth token.
An access token will be generated for you.
Now, refer to the "In OneLogin" tab for steps on how to finish setting up the integration in OneLogin.

Log into OneLogin and go to ‘Applications’, click on the 15Five application.
Click on the Configuration setting to open up the SCIM settings in OneLogin.
Enter your SCIM token in your OneLogin Configuration setting and the SCIM URL that you generated in 15Five. Typically, this URL will be the following: https://yoursubdomain.15five.com/scim/v2.
Be sure to remove the trailing slash if there is one. For example: https://yoursubdomain.15five.com/scim/v2 NOT https://yoursubdomain.15five.com/scim/v2/.
Click the Enable button and check that your credentials were verified successfully. The API Status indicator will change to a green “Enabled” if the credentials were verified successfully.
Click the ‘Provisioning’ tab and scroll to the ‘Workflow’ section. Ensure the 'Enable provisioning' box is checked and ‘When individuals are deleted in OneLogin, perform this action in 15Five’ is set to Delete.
Assign the 15Five application to each person. If you would like to delay provisioning an individual to 15Five before a certain date, see the section below about ‘Start Dates’ before assigning them to 15Five. When giving 15Five access to a OneLogin user for the first time, a new person will be created in 15Five.

✏️

Note

For updates made to people in OneLogin to propagate down to 15Five, those people in 15Five must be known to OneLogin. Thus, after setting up SCIM it's important to: 1. Check that all the people who were in 15Five prior to setting up SCIM are added to the 15Five application in OneLogin. Once added to the 15Five application in OneLogin, individuals will be matched with the corresponding person in 15Five. 2. Navigate to the "Users" page in the OneLogin application and check that the "Provisioning State" for each person is listed as "provisioned".

Start dates for delaying invites to 15Five

If you want people to access 15Five on a specific date, you can use start dates.
Start dates determine when employees can log in to 15Five and begin receiving notifications.

✏️

Note

Add the start date before assigning a person to 15Five in OneLogin. If no date is set, 15Five assumes they should start immediately and sends a welcome email right away.

To send start dates to 15Five, follow these steps:

Within OneLogin, click on the 'Users' tab and then on the 'Custom User Fields' tab.
Click on New User Field.
Enter the following information for the new field:
- Name: Start Date
- Shortname: startDate
Navigate to the 15Five integration within OneLogin.
Go to Parameters and click on Start Date under 'Optional Parameters'.
- Change the start date parameter to use the value in the 'Start Date (Custom)' field.
- Ensure 'Include in User Provisioning' is checked.
- Click Save.

How to Sync OneLogin with 15Five

SCIM syncing occurs automatically whenever a field changes in OneLogin.
To trigger a sync, simply update a field for a person in OneLogin.

15Five identifies people in this order: SCIM ID → User ID → Email → Employee ID.
If fields like managerId aren’t syncing correctly, check how these fields are mapped in OneLogin or downstream apps.
If issues persist, visit our Contact 15Five page for support.

Groups

✏️

Note

Groups created within OneLogin (at https://subdomain.onelogin.com/groups) cannot be pushed to 15Five. Instead, in order for membership to be managed via SCIM, groups must be created in 15Five and imported into OneLogin.

First, add your group in 15Five here. Below, we've added a group called "Leadership".
Then, within OneLogin, navigate to the 15Five app and to the 'Provisioning' tab within the app.
Under Entitlements, click Refresh to import all groups from 15Five.
In a user’s profile, move a group from Available Values to Selected Values, then click Save.
The person will now appear as a member of that group in 15Five.

✏️ Note: Group types (like Departments or Teams) aren’t managed through SCIM. When a new group gets created and synced over via SCIM, that new group will go into the 'Groups' group type. They can be organized manually within 15Five. SCIM only syncs group creation, names, and membership.

Screen_Shot_2021-06-09_at_4.26.42_PM.png

Disconnect OneLogin

In 15Five, navigate to your SCIM settings.
Uncheck the Enabled box.
Once disconnected, people’s accounts remain active in 15Five, but data will no longer sync from OneLogin.

Troubleshooting and FAQs

How often does SCIM sync data from OneLogin to 15Five?
Syncing happens immediately when a change is made in OneLogin.

Can SCIM update custom attributes in 15Five?
Not at this time. You can use bulk import or manually update profiles. Contact 15Five to enable bulk imports for SCIM-enabled companies.

Can I sync people in bulk from OneLogin?
No. OneLogin doesn’t support bulk SCIM syncs. To re-sync users, remove and reassign them to the 15Five app.

Can I manually add people if SCIM is on?
Manual adds aren’t supported when SCIM is enabled. You can import via CSV if needed— please visit Contact 15Five to contact us to enable this option.

Will enabling SCIM delete existing data in 15Five?
No. Existing user data stays intact as long as the email addresses match. You may need to reimport users for SCIM to begin managing them.

Can I sync employee time zones?
Not currently supported.

Why isn’t an employee’s manager syncing correctly?
Check that Sync Managers is enabled in your SCIM settings.
If the manager didn’t exist in 15Five before assignment, perform a Force Sync or change the manager field to trigger another sync.
If needed, unassign and reassign the person to 15Five (this sends a “Welcome Back” email).

Can group admins be synced from OneLogin?
No. You can sync groups, but group admin roles must be set manually in 15Five.