# Workspace administration

Learn how to manage your Slack workspace or Enterprise org.

## Manage members with SCIM provisioning

**Who can use this feature?**

- **Org Owners**/ **Admins** and **Workspace Owners**/ **Admins**
- Available on the **Business+** and **Enterprise** plans
- Available on the **Free** and **Pro** plans if you've [connected a Salesforce org to Slack](https://slack.com/help/articles/30754346665747-Connect-Salesforce-and-Slack)

Slack supports member provisioning with the System for Cross-domain Identity Management (SCIM) standard. To use provisioning, you’ll need to use a connector app alongside a supported identity provider (IDP).

**Tip:** If you’d like to build a custom script to handle provisioning, [head to Slack API to review our SCIM API documentation](https://api.slack.com/scim).

## Manage members

SCIM provisioning allows you to manage members in your Slack workspace or Enterprise organization more efficiently. Here's what you can do:

- Create or deactivate a member
- Create or deactivate a Multi-Channel Guest*
- [Sync and update members' profile fields](https://api.slack.com/scim?_gl=1*11fgish*_gcl_aw*R0NMLjE2NTczMDA1NTQuQ2p3S0NBandxNS1XQmhCN0Vpd0FsLUhFa2tVbW82ZUpEdWJ1NUkxeVpYNTVpaGVDLUQzRDkwTWJmZ0RhQ3d1N1YxOS1iYmZLdFIxVmJ4b0NaTGtRQXZEX0J3RQ..*_gcl_dc*R0NMLjE2NTczMDA1NTQuQ2p3S0NBandxNS1XQmhCN0Vpd0FsLUhFa2tVbW82ZUpEdWJ1NUkxeVpYNTVpaGVDLUQzRDkwTWJmZ0RhQ3d1N1YxOS1iYmZLdFIxVmJ4b0NaTGtRQXZEX0J3RQ..#user-attributes)
- Create or delete a [user group](https://slack.com/help/articles/212906697-Create-and-edit-user-groups)**
- Add or remove members from a user group

*Only available on Enterprise plans. If you’d like to create a Single-Channel Guest, or create a guest on the Pro or Business+ plan, you can create a member and then [change their role to a guest](https://slack.com/help/articles/218124397-Change-a-members-role#manage-guest-roles).

**Note:** It’s not possible to set up unique display names for user groups with SCIM provisioning.

## **Set up provisioning**

Your SCIM provisioning setup will vary depending on the identity provider you use. We support these IDPs:

- [Google Workspace (SAML)](https://support.google.com/a/answer/6399782?hl=en)
- [Microsoft Entra](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-slack-provisioning-tutorial)
- [Okta](https://help.okta.com/en-us/content/topics/provisioning/slack/slck-integrate-slack.htm)
- [OneLogin](https://onelogin.service-now.com/support?id=kb_article&sys_id=6ab95d03db109700d5505eea4b9619c1)
- [PingFederate](https://docs.pingidentity.com/integrations/slack/pf_slack_connector.html)
- [PingOne](https://documentation.pingidentity.com/pingone/employeeSsoAdminGuide/index.shtml#selectDirectory.html)

During setup, your identity provider will ask for an API token created through the [OAuth 2.0](https://api.slack.com/authentication/oauth-v2) flow. Slack also supports live syncing of Active Directory groups for workspaces using these identity providers.

**Note:** If you're on a paid Slack plan, members and guests added through SCIM are billable as soon as they sign in for the first time. The cost of new accounts will be prorated for the remainder of your current billing period.