JA EN
shiichan

Now you can sync an entire SCIM group in just one request!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey everyone, it's Shii! Today I found a small but genuinely useful update on the Cloudflare changelog for anyone syncing groups through an identity provider, so let's dive in!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's changelog announced that SCIM in the Cloudflare Dashboard now supports group replacement via HTTP PUT, following the specification defined in RFC 7644 section 3.5.1. This lets identity providers (IdPs) synchronize a group's full state — its display name, external ID, and members — in a single request.

The story so far

SCIM (System for Cross-domain Identity Management) generally supports two ways to update a resource: PATCH, which sends only partial changes, and PUT, which replaces the entire resource at once. Some IdPs sync groups using replacement semantics, sending the group's complete state rather than incremental diffs. Paired with an IdP that works that way, the lack of full PUT support could leave Cloudflare's group state out of sync.

What changes

With PUT-based group replacement now supported, compatibility with IdPs that use replacement semantics is improved. An IdP can send a group's display name, external ID, and member list in one request, and Cloudflare's group is updated to match exactly. For organizations that treat their IdP as the source of truth for group membership, that means one less thing to worry about drifting out of sync.

Dive Deep

This update follows the specification in RFC 7644 section 3.5.1, so a standards-compliant SCIM client should be able to send PUT requests without extra customization. A few requirements to keep in mind:

  • SCIM provisioning in the Cloudflare Dashboard is available to Enterprise plan customers
  • Completing the initial setup requires Super Administrator access
  • What gets replaced is the group's display name, external ID, and membership

Cloudflare's official SCIM provisioning overview documentation covers the detailed setup steps.

Wrap-up

  • The Cloudflare Dashboard's SCIM integration now supports group replacement via HTTP PUT
  • It follows RFC 7644 section 3.5.1, syncing display name, external ID, and members in one request
  • Compatibility with IdPs that use replacement semantics is improved
  • Available to Enterprise plan customers only, with Super Administrator access required for initial setup

If you manage groups centrally through your IdP and have run into sync drift with Cloudflare before, this update is for you!

Related posts