Riven SCIM Proxy
LiveDirectory sync for organizations: users and groups provisioned and deprovisioned from your identity provider, so access follows employment.
For an organization of any size, managing Riven membership by hand is both toil and a security problem. SCIM Proxy connects your identity provider directly, so joiners, movers, and leavers are reflected without a ticket.
What syncs#
| Event in your directory | Effect in Riven |
|---|---|
| User created / assigned the Riven app | Account provisioned in your workspace with role from group mapping |
| Attributes change (name, email, department) | Profile updated on next sync |
| Group membership changes | Role and surface access recalculated |
| User deactivated or offboarded | Access revoked and sessions invalidated |
Group-to-role mapping#
Roles are driven by directory groups rather than set per user in Riven, which keeps one system authoritative. Map a group to a role once and membership changes take effect on sync — including removal, which is the case that matters most.
Relationship to Riven Auth#
The two solve different halves of identity. Riven Auth handles *authentication* — proving who is signing in, via BetterAuth with Microsoft Entra ID for enterprise tenants. SCIM Proxy handles *provisioning* — making sure the account and its permissions exist before the person signs in, and stop existing when they leave. SSO alone leaves deprovisioning unsolved, which is why both exist.
Deprovisioning is the point#
When someone leaves, their Riven access ends with the directory event. Sessions are invalidated and workspace resources stay with the organization. API keys minted by that user are surfaced for review rather than silently orphaned — a key outliving its owner is exactly the gap this closes.
SCIM is available on Enterprise plans. Setup is per-tenant — start from rivenai.io/contact or your Enterprise contact.