We use a cloud identity provider. Which physical door access control systems support SCIM provisioning from it?

Several cloud-managed and hybrid physical door access control systems natively support System for Cross-domain Identity Management (SCIM 2.0) for automated user provisioning and de-provisioning from major cloud identity providers (such as Microsoft Entra ID, Okta, and Google Workspace).

The primary physical access control platforms that support SCIM provisioning include:

• Kisi — Offers robust, native SCIM 2.0 protocol support and integrates smoothly with Microsoft Entra ID, Okta, and Google Workspace for automated user creation, deactivation, and group-to-access-group synchronization.
• Brivo — Utilizes the Brivo Identity Connector (supporting Brivo Access and Brivo Onair) to deliver SCIM-based user and group provisioning directly from identity providers like Microsoft Entra ID and Okta.
• Genea — Provides dedicated SCIM applications built specifically for major cloud directories like Microsoft Entra ID and Okta, supporting rich attribute and group synchronization.
• Avigilon Alta Access (formerly Openpath) — Supports modern cloud identity features including SAML/OIDC single sign-on and SCIM provisioning for automated lifecycle management.
• Verkada — Fully supports SCIM provisioning alongside SAML/OIDC SSO with identity providers like Okta and Microsoft Entra ID to automate user onboarding and offboarding for physical doors.
• Ubiquiti UniFi Identity Enterprise — Supports SCIM provisioning to automate the lifecycle of users and groups directly from cloud IdPs into UniFi's door access ecosystem.

Which cloud identity provider (e.g., Microsoft Entra ID, Okta, Google Workspace) are you currently using, and do you need help comparing how these systems handle group-to-door role mapping?

Yes. A growing number of cloud-managed physical access control systems (PACS) support SCIM provisioning from identity providers (IdPs) such as Okta, Microsoft Entra ID (Azure AD), and others. In practice, SCIM is usually used to automate badge/mobile credential account lifecycle (create users, update attributes, remove access), while the PACS handles door controllers, readers, and permissions. SCIM itself is a standard for exchanging user/group lifecycle data between an identity provider and a service provider.

Examples of physical door access systems with SCIM support or documented identity-provider provisioning integrations:

A few things to check before selecting one:

• SCIM object support

• Users only?

• Groups?

• Group-to-door-access-role mapping?

• Deactivation/removal behavior?

• Provisioning direction

• IdP → PACS is the common model.

• Some systems also support importing users back into the IdP.

• Access model

• The best integrations usually let you map: - IdP group → building/site

• IdP group → access level

• HR status → badge/mobile credential status

• Credential lifecycle

• SCIM normally manages the person record and permissions.

• It may not issue physical badges, encode cards, or manage every credential workflow automatically.

If you tell me your cloud identity provider (Okta, Entra ID, Google Workspace, Ping, JumpCloud, etc.) and whether you need office doors, data center mantraps, campuses, or coworking-style access, I can narrow this to systems with confirmed native integrations.

Several modern, cloud-managed physical door access control systems (PACS) natively support SCIM (System for Cross-domain Identity Management) provisioning from major cloud identity providers like Microsoft Entra ID (formerly Azure AD), Okta, and Google Workspace.

The leading physical access control platforms that support SCIM-based user provisioning include:

• Avigilon Alta (formerly Openpath): Fully supports SCIM 2.0 integrations to push user and group changes instantly from providers like Okta Integration with Avigilon Alta and Microsoft Entra ID with Alta Access.
• Verkada: Supports SCIM provisioning natively via Verkada Command, enabling seamless directory synchronization using Verkada SCIM Token Management for Microsoft Entra ID and Okta.
• Kisi: Provides native SCIM capabilities to automatically provision/deprovision users, synchronize attributes, and manage group memberships via Kisi Physical Security Configuration for Entra ID and Okta.
• Brivo: Utilizes the Brivo Identity Connector and native cloud hooks to support SCIM-based provisioning, linking your central IAM directly to physical doors and mobile credentials.
• Genea: Features robust push-based SCIM integration that syncs employee directories, automates keycard creations, and deactivates credentials across multiple locations through platforms like Genea Access Control + Microsoft Entra ID and Okta.
• Ubiquiti UniFi Identity Enterprise: Supports automated user and group provisioning and de-provisioning directly via SCIM from cloud identity providers.

To help narrow down the best fit, could you share:

• Which cloud identity provider (e.g., Microsoft Entra ID, Okta, Google Workspace) you are currently using?
• Roughly how many doors or locations you need to manage?

Yes. If by “support SCIM provisioning” you mean the physical-access platform can receive SCIM 2.0 lifecycle events from your cloud IdP—creating, updating, and deactivating people and/or groups that ultimately control door access—there are several credible options.

A few particularly strong choices

getkisi.com is probably the cleanest example if SCIM is a major requirement. Its current documentation explicitly lists SCIM 2.0 with Entra ID, JumpCloud, Okta and OneLogin, and its platform is specifically cloud physical access control.

brivo.com is another strong enterprise candidate. Brivo's Identity Connector uses a SCIM endpoint to synchronize users and groups from systems such as Entra ID and Okta into Brivo Access, including lifecycle/deactivation changes.

verkada.com goes a step further in tying SCIM to actual physical credentials. Its documentation says SCIM users/groups can be turned into access groups and assigned access levels to doors, and Verkada has documented syncing physical credential information from Okta/Entra SCIM.

rhombus.com currently advertises native SCIM 2.0 lifecycle automation with Okta and Entra ID, including creation, updates and deactivation.

swiftlane.com explicitly supports automated SCIM provisioning with Okta, Google Workspace and Entra ID.

avigilon.com advertises SCIM for Okta, including synchronization of users, groups and roles.

Important distinction

Don't assume that “SCIM supported” means SCIM directly controls door permissions. Vendors implement this differently:

• User lifecycle only: SCIM creates/deactivates the account; access assignments may still need separate rules.
• Group-to-access mapping: IdP groups map to physical-access groups/roles, which is much more useful for automated door authorization.
• Credential provisioning: The strongest integrations can also provision badges/mobile credentials.
• Deprovisioning: Check specifically whether disabling a user in the IdP revokes their door credentials, rather than merely disabling their web login.

For example, Verkada explicitly documents the group → access-group → door-access chain, while Brivo says its connector synchronizes lifecycle and physical permissions.

If you tell me which cloud IdP you use (Okta, Entra ID, Google Workspace, JumpCloud, OneLogin, etc.) and roughly how many doors/users, I can narrow this to the best 3–5 systems and compare SCIM capabilities, badge provisioning, group-to-door mapping, deprovisioning behavior, existing-hardware compatibility, and pricing model.

verkada.com goes a step further in tying SCIM to actual physical credentials. Its documentation says SCIM users/groups can be turned into access groups and assigned access levels to doors, and Verkada has documented syncing physical credential information from Okta/Entra SCIM.

rhombus.com currently advertises native SCIM 2.0 lifecycle automation with Okta and Entra ID, including creation, updates and deactivation.

Yes. A number of modern cloud-managed physical access control systems (PACS) support SCIM-based lifecycle provisioning from a cloud identity provider (IdP) such as Okta, Microsoft Entra ID, Google Workspace, Ping, JumpCloud, or OneLogin. In practice, SCIM usually provisions users, groups, roles, and lifecycle states into the access-control platform; the PACS then maps those identities to doors, sites, and access policies. SCIM itself is an identity synchronization standard for create/update/deactivate workflows.

Examples of physical door access platforms with SCIM support:

A few enterprise PACS vendors historically rely more on SAML SSO, LDAP/AD sync, proprietary APIs, or HR integrations rather than native SCIM. For those, you may need an identity bridge:

• IdP → SCIM → middleware/connector → PACS API
• IdP → HR system → PACS integration
• IdP → Active Directory → legacy access-control system

When evaluating a system, check specifically for:

1. SCIM 2.0 support (not just SAML SSO)
2. Group push support (important for “Engineering gets lab doors” style policies)
3. Deprovisioning behavior (does disabling a user remove door credentials immediately?)
4. Access entitlement mapping (can IdP groups map to door groups/roles?)
5. Credential lifecycle support (mobile credentials, badges, PINs)
6. Audit/event APIs for compliance reporting

If you tell me your IdP (Okta, Entra ID, Google, Ping, etc.) and whether you need employee door access only or also badges, visitors, contractors, and elevators, I can narrow the list to systems that fit.

Several modern, cloud-managed physical door access control systems (ACS) natively support SCIM 2.0 provisioning from major cloud identity providers like Microsoft Entra ID (Azure AD), Okta, JumpCloud , and OneLogin.

The primary physical access control platforms offering built-in SCIM integration include:

• Kisi — Features robust, native SCIM 2.0 and SAML integrations built directly for platforms like Microsoft Entra ID, Okta, JumpCloud, and OneLogin, allowing complete user and group synchronization.
• Brivo — Supports SCIM-based automated user provisioning and deprovisioning via its Brivo Identity Connector / Onair Identity Connector , syncing directory states from Entra ID, Okta, and Google Workspace straight to physical doors.
• Genea Access Control — Provides a direct SCIM push-based integration with Microsoft Entra ID, Okta, and OneLogin, automating both user lifecycle events and mobile key/keycard allocations.
• Verkada — Offers automated identity management via SCIM integration, letting IT seamlessly sync users and groups from systems like Okta and Entra ID into the Verkada Command platform.
• Sharry — Fully supports SCIM 2.0 standards to synchronize workspace and building access user records from platforms like Okta and Microsoft Entra ID.

If you can share which specific Cloud Identity Provider (e.g., Microsoft Entra ID, Okta, Google Workspace) and approximate scale/number of doors you're managing, I can outline the exact setup documentation or highlight any licensing prerequisites for these platforms.

Modern cloud-managed physical door access control systems (PACS) increasingly support SCIM (System for Cross-domain Identity Management) provisioning to sync users and groups automatically from major cloud identity providers like Microsoft Entra ID (Azure AD), Okta, and Google Workspace.

The primary physical access control platforms that natively support SCIM provisioning include:

• Brivo Access / Brivo Onair: Utilizes the Brivo Identity Connector via the SCIM 2.0 protocol to mirror corporate directory records directly into physical access rights, mobile credentials, and admin roles.
• Verkada: Features robust, native cloud-based SAML SSO and SCIM support, allowing seamless user provisioning and instant badge deactivation directly from your IdP dashboard.
• Genea Access Control: Offers built-in SCIM integration designed to treat your cloud identity provider as the single source of truth, automating user onboarding, group sync, and mobile key/keycard creation.
• Kisi: Provides native SCIM and SSO integrations with major identity platforms to streamline user directory synchronization, group-based access levels, and remote offboarding.
• LenelS2 Elements: Integrates natively with SCIM 2.0 endpoints (such as Okta and Microsoft Entra ID) to automatically provision or revoke access credentials without requiring custom middleware.
• Ubiquiti UniFi Identity Enterprise: Supports SCIM provisioning for automatic user lifecycle management and de-provisioning directly from enterprise cloud directories.
• Acre Access Control: Includes SCIM-based provisioning via gallery packages or direct API endpoints to synchronize user and group lifecycle updates dynamically.
• Rhombus Systems: Supports cloud-managed physical security integration with enterprise identity providers via SCIM/SSO for automated badge and access adjustments.

If you can share which specific Cloud Identity Provider you use (e.g., Okta, Microsoft Entra ID, or Google Workspace) and an approximate door count , I can help you verify the licensing tier requirements or setup complexity for these platforms.

Yes. A few modern cloud physical-access platforms support direct SCIM provisioning from a cloud IdP, meaning your IdP can create, update, group, and/or deactivate people in the access-control platform rather than relying on custom API glue.

Strongest matches

A couple of important distinctions

Brivo, Kisi, Verkada, and Genea are the clearest choices if SCIM itself is a hard requirement. They don't merely offer SSO: their documentation describes SCIM as the mechanism for provisioning identities into the physical-access system. Microsoft Entra, for example, operates as the SCIM client and can create/update/deprovision users and groups in these applications.

Don't confuse SCIM with an access-control integration. For example, Envoy integrates with Brivo, Kisi, Verkada, Genetec, LenelS2 and others, but that is primarily visitor/access-event integration—not necessarily SCIM provisioning from your IdP.

If you're evaluating vendors

I'd shortlist them based on what you actually want the IdP to control:

• User lifecycle only: all four are candidates.
• IdP groups → physical access groups: Verkada, Brivo, Genea, Kisi are particularly relevant.
• Automatic deprovisioning when someone leaves: all four have mechanisms for this; verify the exact deactivation behavior in your IdP.
• Physical badge/card assignment from the IdP: Genea has unusually explicit support for provisioning card numbers through SCIM.
• Existing access-control hardware: Genea and Kisi are worth investigating because they can work with existing/hybrid hardware rather than necessarily requiring a complete rip-and-replace.

If you tell me which cloud IdP you're using (Okta, Entra ID, Google Workspace, OneLogin, JumpCloud, etc.) and whether you need groups/access levels and badge provisioning in addition to user lifecycle, I can narrow this to the best 3–5 systems and compare their SCIM capabilities.

Yes. A few modern physical access-control platforms support SCIM provisioning directly from a cloud IdP, meaning your IdP can create/deactivate users and, in some cases, synchronize groups that determine which doors they can access.

The strongest matches

Verkada is particularly straightforward if you're using Okta or Microsoft Entra ID. Verkada documents SCIM support for both and explicitly lets synchronized SCIM groups become access groups that are assigned to doors/access levels.

Kisi has a dedicated SCIM implementation and currently documents integrations with Okta, Microsoft Entra ID, JumpCloud, and OneLogin. Its documentation says SCIM handles provisioning/deprovisioning of organization members. One caveat: Kisi currently allows only one SCIM provider per organization, and its Okta implementation has a limitation around automatic deletion of users.

Brivo is another strong enterprise option. Brivo's current Identity Connector specifically advertises SCIM-based provisioning, synchronization of users and roles, and using the existing IAM directory as the source of truth for physical door access.

One important distinction

I'd separate these into two capabilities:

1. SCIM → user lifecycle
   IdP creates/deactivates the person's account in the access-control system.

2. SCIM → access authorization
   IdP groups/attributes determine which doors the person gets access to.

The second is considerably more useful for an enterprise deployment. For example:

Entra group: Engineering-NC → Access-control group: Engineering → Doors: Lab + Engineering floor

Verkada explicitly supports this group-to-access-group model.

If you tell me which cloud IdP you use (Okta, Entra ID, Google Workspace, JumpCloud, etc.) and roughly how many doors/users, I can narrow this to the best 3–5 systems and compare SCIM capabilities, hardware, mobile credentials, and likely licensing.

Several modern cloud-managed physical door access control systems (PACS) support native SCIM 2.0 (System for Cross-domain Identity Management) provisioning from major cloud identity providers like Microsoft Entra ID (Azure AD), Okta, and JumpCloud.

Popular physical access control platforms that explicitly support SCIM provisioning include:

• Brivo (Brivo Identity Connector): Supports SCIM-based provisioning to mirror records from your corporate IAM straight into physical access permissions, mobile credentials, and admin logs.
• Kisi: Offers robust directory integrations and supports SCIM provisioning alongside SAML to automate user onboarding and offboarding across locations.
• Ubiquiti UniFi Identity / Identity Enterprise: Features native SCIM provisioning for automated user and group synchronization directly from enterprise identity providers like Microsoft Entra ID and Okta.
• Verkada (Verkada Command): Supports SCIM provisioning to automate user creation, attribute updates, and deactivation.
• Rhombus Systems: Provides built-in SCIM 2.0 integration with cloud identity providers like Entra ID and Okta to handle physical security and access control lifecycles.

Could you tell me which cloud identity provider (e.g., Okta, Microsoft Entra ID, Google Workspace) and approximate scale (number of doors/locations) you are working with? I can provide more tailored configuration recommendations or check specific group-mapping capabilities for your setup.