Skip to main content

Add and remove lemlist team members automatically from Okta or Microsoft Entra ID (SCIM)

Connect your identity provider with SCIM so that people you assign to the lemlist app get an account and a seat in your team, and people you unassign or deactivate leave the team and free their seat.

SCIM lets your identity provider (IdP), such as Okta or Microsoft Entra ID, manage your lemlist team for you. When you assign someone to the lemlist app in your IdP, lemlist creates their account and adds them to your team. When you unassign them, or deactivate them in your IdP, lemlist removes them from the team and frees their seat.

This article starts with the settings every IdP needs, then gives the exact steps for Okta and for Microsoft Entra ID.

Note: SCIM user provisioning is in beta and available on the Enterprise plan. Ask your lemlist account manager to turn it on for your team.

Limitations

  • Groups are not supported. lemlist has no groups. You can assign people to the app individually or through groups in your IdP, but do not turn on group push or group sync.

  • Roles are not supported. Every provisioned person joins as a member. To make someone an admin, change their role in lemlist.

  • The person's email address (userName) is their lemlist login. It cannot be changed over SCIM.

  • SCIM creates and removes members. It does not set up sign-in. To let your people log in with your IdP, also set up SSO in Settings → Team → Log in with your organization (SSO) for your entire team.

  • Suspending a user in Okta does not remove them from lemlist.

  • lemlist never removes the last admin of the team.

  • When you assign someone again, the mailboxes and phone numbers that left the team are not restored. A person who was an admin comes back as a member.

  • By default, a team can have up to 200 active members provisioned by SCIM, and can make up to 600 SCIM requests per minute (see Seats and limits).

Before you start

  • Your lemlist team is on the Enterprise plan, and your lemlist account manager has turned on SCIM for your team.

  • You are an admin of the lemlist team. Only admins can create or revoke the SCIM token.

  • You are an admin in your IdP, with the right to create an application and set up provisioning.

  • Your company's email domain is verified in Settings → Team → Log in with your organization (SSO) for your entire team. lemlist only creates a new account, or brings in an account your IdP is not tracking for your team, when its email address is on a domain your team verified. A person who left your team by themselves, or whom your IdP deleted, counts as an account your IdP is not tracking.

  • Your team has enough seats for the people you plan to assign. Each provisioned person takes one lemlist seat.

Important: You verify a domain by email or with a DNS record. Once the domain is verified, the SSO setup shows your list of domains. If you only want to verify the domain, close the window there. If some members of your team have an address on another domain, clicking Next on that list opens a list of those members, and clicking Next again removes them from your team.

Phase 1: Generate your SCIM token in lemlist

  1. In lemlist, go to Settings → Team.

  2. Find the User provisioning (SCIM) block, right under the SSO block.

  3. Click Generate token.

  4. The Your SCIM token window shows two values. Copy both:

    • SCIM base URL: https://api.lemlist.com/api/scim/v2

    • SCIM token: a long value that starts with lemscim_

  5. Click I have copied the token.

    ✅ Verify: the User provisioning (SCIM) block shows the last four characters of the token, when it was created and when it was last used.

Important: The token is shown only once. If you lose it, click Regenerate token: the old token stops working at once, so paste the new one in your IdP right away. Revoke stops provisioning until your IdP receives a new token. Revoking or regenerating does not change the people already in your team. Your team has one SCIM token at a time.

Phase 2: Connect your identity provider

Whatever your IdP, you give it the same information:

  • SCIM base URL (also called Tenant URL or connector base URL): https://api.lemlist.com/api/scim/v2

  • Authentication: bearer token, the lemscim_... token from Phase 1. Okta wants the word Bearer before the token. Microsoft Entra ID wants the token alone.

  • Unique identifier for users: userName (the person's email address)

  • Provisioning actions to turn on: create users, update user attributes, deactivate users

  • Groups: not supported. Do not turn on group push or group sync.

Connect Okta

Okta provides a ready-made app for SCIM 2.0 with a bearer token, called SCIM 2.0 Test App (Header Auth). Use it to connect lemlist.

  1. In the Okta Admin Console, go to Applications, then Browse App Integration Catalog.

  2. Search for SCIM 2.0 Test App (Header Auth), open it and click Add Integration.

  3. In Application label, enter a name such as "lemlist SCIM", click Next, then Done.

  4. Open the Provisioning tab and click Configure API Integration.

  5. Check Enable API integration and fill in:

    • Base URL: https://api.lemlist.com/api/scim/v2

    • API Token: the word Bearer, a space, then your token, for example Bearer lemscim_.... The token alone is refused.

  6. Click Test API Credentials, then click Save.

    ✅ Verify: Okta shows SCIM 2.0 Test App (Header Auth) was verified successfully!

  7. In Provisioning → To App, click Edit, check Create Users, Update User Attributes and Deactivate Users, then click Save.

  8. Open the Assignments tab and click Assign → Assign to People (or Assign to Groups) to choose who gets a lemlist account.

Okta never sends a deletion for a user. When you unassign or deactivate someone, Okta sets them as inactive, and lemlist removes them from the team. Suspending a user in Okta does not remove them from lemlist.

Connect Microsoft Entra ID

You create a non-gallery enterprise application.

  1. In the Microsoft Entra admin center, go to Entra ID → Enterprise apps and click New application.

  2. Click Create your own application, give it a name (for example "lemlist"), choose Integrate any other application you don't find in the gallery, and confirm.

  3. In the app, open Provisioning and click Connect your application.

  4. Choose bearer token (secret token) authentication, not OAuth, and fill in:

    • Tenant URL: https://api.lemlist.com/api/scim/v2

    • Secret Token: your lemscim_... token, without the word Bearer

  5. Click Test Connection, then Create.

  6. Under Attribute mapping, check the user mapping: userName comes from userPrincipalName, which must be the email address people use in lemlist. givenName maps to name.givenName and surname to name.familyName. Disable the group mapping.

  7. Under Settings, set Scope to Sync only assigned users and groups.

  8. Go to Users and groups and assign the people who should get a lemlist account.

  9. To check one person right away, use Provision on-demand. Then click Start provisioning.

  • Entra runs a provisioning cycle about every 40 minutes, so changes can take up to that long to reach lemlist.

  • Assigning individual users works on every Entra ID plan. Assigning groups needs Entra ID P1 or P2.

  • When you unassign someone, Entra sets them as inactive and lemlist removes them from the team.

  • When you delete someone in Entra, Entra first disables them, then sends a deletion 30 days later.

Phase 3: Check that it works

  1. Assign one test person in your IdP.

  2. In lemlist, open your team's member list.

    ✅ Verify: the person is there as a member. When SCIM creates a new account, your team's admins also receive an email that a new member joined.

  3. Unassign the test person.

    ✅ Verify: they leave your team and their seat is free again.

What lemlist does when you change someone in your IdP

You assign a new person

If the email address is on a domain your team verified, lemlist creates the account, with the email address already verified and no password, and adds the person to your team as a member, on one seat. Otherwise the IdP shows an error (see Troubleshooting).

You assign someone who already has a lemlist account in another team

lemlist adds that account to your team, only if its email domain is verified in your team's SSO settings. Otherwise the IdP shows an error (see Troubleshooting).

You change a first or last name

lemlist updates the name. If the person also belongs to another lemlist team and their email domain is not verified in your SSO settings, lemlist keeps the name as it is.

You unassign or deactivate someone

lemlist removes the person from your team and frees the seat. The account is not deleted. Your team keeps its data. The person's mailboxes leave the team, so campaigns that sent from them lose that sender.

The person you unassigned is in no other lemlist team

Their own personal team counts as a team. If their email address is on a domain your team verified, their account is also blocked: their sessions end and the API keys they created stop working. Otherwise lemlist removes them from your team the way an admin does, without blocking the account. Very old API keys that lemlist does not link to the person who created them are not affected by the block.

You assign them again

lemlist puts the person back in your team as a member, on a seat, and unblocks the account. Mailboxes and phone numbers that left the team are not restored. A person who was an admin comes back as a member.

Your IdP deletes the user

Same as unassigning, and the IdP no longer sees the person. If you assign them again later, lemlist treats them as an account from outside your team.

An admin removes someone from the team in lemlist

Your IdP still sees them, as inactive. If the person is still assigned in your IdP, your IdP can put them back in the team, without the domain check. Unassign them in your IdP too.

Someone leaves your team by themselves in lemlist

Your IdP no longer sees them. If you assign them again, lemlist treats them as a new person.

When lemlist cannot remove someone

  • This user is the last administrator of the lemlist team. ... lemlist never removes the last admin. Make another member an admin in lemlist first.

  • This user is the last member of a paying lemlist team and cannot be removed from it. Keep at least one member in the team, or contact lemlist support.

  • The lemlist team has a failed payment; members cannot be removed until it is settled. Settle the payment in lemlist billing, then retry.

How provisioned people sign in

People created by SCIM have no lemlist password. They sign in with your team's SSO, or with a magic link. They can also set a password with Forgot password on the login page. If your team requires SSO sign-in for their email domain, they sign in with SSO only.

Supported attributes

  • userName: the person's email address and lemlist login. It cannot be changed over SCIM.

  • name.givenName, name.familyName: first and last name.

  • active: true to be in the team, false to be removed from it.

  • externalId: the IdP's own identifier for the person. lemlist stores it and lets your IdP search by it.

  • displayName, emails: read only. lemlist builds them from the name and the login.

Seats and limits

  • Seats. Each provisioned person takes a lemlist seat. When your team has no seat left, the IdP shows: The lemlist team has no seat left. Buy more seats in lemlist, then retry. Buy seats in lemlist, then retry the assignment in your IdP.

  • Provisioning limit. By default, a team can have up to 200 active members provisioned by SCIM. Above that, the IdP shows: This lemlist team may provision at most 200 members over SCIM. Contact lemlist support to raise the limit.

  • Rate limit. Your team can make up to 600 SCIM requests per minute. Above that, lemlist answers with HTTP 429 and a Retry-After header of 60 seconds.

Practical example

An employee leaves your company. You unassign them from the lemlist app in Okta. Okta sets them as inactive, and lemlist removes them from your team and frees their seat. Your team keeps its data. Their mailboxes leave the team, so the campaigns that sent from them lose that sender: check those campaigns before you unassign the person.

Troubleshooting and pitfalls

Issue: 401, Missing or invalid bearer token, when you test the connection

Root cause: The token is not the latest one, is incomplete, or is not in the format your IdP expects.

Fix:

  • Use the latest token generated in lemlist, copied in full.

  • In Okta, write Bearer and a space before it. In Microsoft Entra ID, paste the token alone.

  • If it still fails, ask your account manager to check that SCIM is enabled for your team.

Issue: ... already has a lemlist account outside this team. Verify its domain in the team's SSO settings, or invite it from lemlist.

Root cause: This person already uses lemlist in another team.

Fix: Verify their email domain in your team's SSO settings, or invite them from lemlist.

Issue: ... is not on a domain this team verified for its SSO. ...

Root cause: The person's email address is on a domain your team has not verified.

Fix: Verify the domain in your team's SSO settings, then retry the assignment. Or invite the person from lemlist.

Issue: The lemlist team has no seat left. Buy more seats in lemlist, then retry.

Root cause: Every seat in your team is taken.

Fix: Buy more seats in lemlist, then retry the assignment in your IdP.

If your case is different

  • If you want your people to log in with Okta, Microsoft Entra ID or Google, see How to set up SSO/SAML in lemlist.

  • If you want to add someone without your IdP, invite them from lemlist.

Related Articles
Did this answer your question?