Cloudflare Access now has SCIM provisioning logs, so every user and group change is visible!

Hey everyone, it's me, Shii-chan! Today I found something that looks small but will genuinely save teams a headache, so let's dig in.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced SCIM provisioning logs for Zero Trust Access. Every create, update, and delete event for users and groups sent in from a SCIM-enabled IdP (identity provider) can now be audited in one place.

You can filter the logs by IdP, event type, result (success/failure), and more. You'll find them in the Zero Trust dashboard under Logs -> SCIM provisioning.

The story so far

Cloudflare Access already supported syncing with SCIM 2.0 identity providers, automating user creation, deactivation, and group membership updates. But there was no unified way to see all of the changes that came in through SCIM.

So when something like "wait, why did this user's group suddenly change, and was it Cloudflare or the IdP?" came up, there wasn't much of a trail on Cloudflare's side to investigate with.

What changes

Every SCIM-driven change is now recorded as an audit log entry, which makes debugging user and group issues much easier. You can confirm directly from the dashboard whether sync from your IdP is arriving correctly, and spot changes you didn't expect.

Dive Deep

Each SCIM request is logged with details like:

• IdP name (which identity provider sent the request)
• Timestamp
• Action (the HTTP method: POST for creation, PUT for a full replacement, PATCH for a partial update, DELETE for removal)
• The user's email address affected
• The group name affected
• Resource type (USER or GROUP)
• Cloudflare's resource ID for the record
• The IdP's resource ID (useful for cross-referencing with your IdP's own records)
• Outcome (SUCCESS or ERROR)
• The request body and the raw JSON log

With all of that captured per request, you should be able to trace mismatches like "the IdP says it sent this, but Cloudflare shows something different" down to a specific request.

One thing to keep in mind: Cloudflare Access won't start provisioning a new user via SCIM until that user has registered the Cloudflare One Client or authenticated to an Access application. So if a user isn't showing up in the logs yet, that's worth checking first.

Wrap-up

• Cloudflare Access now has an audit log for every SCIM-driven user/group create, update, and delete event
• Find it in the Zero Trust dashboard under Logs -> SCIM provisioning
• You can filter by IdP, event type, outcome, and more
• Both the IdP's resource ID and Cloudflare's resource ID are recorded, making it easier to cross-check against your IdP

If you've ever scratched your head wondering why someone's group membership changed through SCIM, this update is for you!