Shopify Plus SCIM: what Okta, OneLogin or Entra can (and can't) do to your Shopify users
If you are the admin wiring Shopify into your identity provider, "does Shopify support SCIM" is not really the question. The question is what happens on the Shopify side when you push a create, a group change or a deactivation — and what happens to the account when someone leaves. This post walks that mapping using only what Shopify's own help pages say: the SCIM, advanced security features, verify-domain and SAML pages, read September 14, 2026. Where Shopify's wording is conditional, it stays conditional here.
Short answer: yes, on Shopify Plus only
Shopify's SCIM page is explicit: "SCIM user management is available only for organizations on the Shopify Plus plan." SCIM is one of the additional security settings a Plus organization adds from the Users > Security section of its Shopify admin.
Inside that organization, the reach stops at your domain: "You can only manage users who are associated with a domain that you've verified for your organization." That verified domain is not a detail — it is the first link in the chain below.
What your identity provider can do through SCIM
Once you give the SCIM API token to your identity provider, Shopify lists three actions you can take through it:
- Create users
- Assign or update groups
- Deactivate users
One thing to build into your joiner flow: users created through SCIM don't receive an invitation email. The user must log in through the identity provider to activate the account, so plan to tell new hires about it yourself.
The chain before you can generate a token
SCIM is the last step of a chain, and Shopify documents each step on its side as available only on the Shopify Plus plan:
- Verify a domain for your organization.
- Set up SAML authentication for the organization.
- Generate the SCIM API token, then give it to your identity provider.
In other words: a verified domain and SAML authentication come first; both are Plus-only, like generating the SCIM token.
Provider setup: Okta, OneLogin, Entra — and everyone else
On the provider side, Shopify's SCIM page carries configuration steps for Okta, OneLogin and Entra, each starting in the Shopify Plus app inside that provider.
With any other provider you might need a base URL as well as the token. If it asks for one, use:
https://shopifyscim.com/scim/v2/
Offboarding: what a removal in your IdP actually does in Shopify
Does removing someone in your identity provider delete them from Shopify? Not necessarily — the outcome depends on what you do in the provider and on whose account it is.
| In your identity provider | In your Shopify organization |
|---|---|
| Remove an active user's access | The user is suspended in your organization |
| Permanently delete a user | They might be deleted, depending on your identity provider setup |
| Remove a store owner or organization owner | Not possible through an identity service provider |
Read the middle row carefully. Suspension is the outcome Shopify states for an active user; deletion is a "might", and it hinges on how your own provider is set up. So plan offboarding around suspension, and check how your own provider handles a permanent delete before you count on the account disappearing.
Owners stay on your manual list
Store owners and organization owners can't be removed through your identity provider. Shopify says both types of ownership must be transferred before the user can be removed — so keep owner accounts on your own, manual offboarding list rather than expecting the IdP to handle them.
The 14-day caveat
Shopify's SAML page adds a caveat about sessions: "If you remove a user from the Shopify application in your identity provider, then they can still access Shopify for up to 14 days." If your offboarding runbook treats "removed from the Shopify application in the IdP" as "locked out of Shopify", that line is the one to correct: per Shopify, the user can still access Shopify for up to 14 days.
Whether a departing account should be suspended or removed at all is a decision of its own, separate from what SCIM can do.
SAML enforcement: Required is your choice, and it reaches wide
SAML itself is the condition for SCIM; its Required enforcement level is your choice. Under it, "All users with email addresses matching your domain must use SAML to log in" — store owners and outside users included. That setting also replaces all individual security requirements for your users.
For the admin, that reach is the point. If you want every account with an email address matching your domain to log in through SAML, Required does that, store owners included. Outside users whose email addresses match your domain fall under it too.
What Shopify's pages don't say
No Shopify page we have read — the SCIM, advanced security features, verify-domain and SAML help pages, as of September 14, 2026 — says whether SCIM also covers POS-only staff. That is an absence, not an answer: don't read it as "POS staff are excluded", and don't read it as "they are included" either. If POS-only accounts are part of your directory, test it in your own organization before you promise it to anyone.
Admin checklist
Pulling the above into the order you will actually hit it:
- Plan gate. SCIM, SAML and domain verification are each documented by Shopify as Plus-only.
- Chain. Verify a domain → set up SAML → generate the SCIM API token → hand it to the IdP.
- Provider. Okta, OneLogin and Entra have documented steps, starting in the Shopify Plus app inside the provider; other providers might need the base URL above.
- Scope. Only users associated with a domain you've verified.
- Actions. Create users, assign or update groups, deactivate users — and no invitation email on create; the user activates by logging in through the IdP.
- Leavers. Removing an active user's access suspends them; a permanent delete might delete them, depending on your provider setup; owners can't be removed through the IdP, and both types of ownership must be transferred first.
- Sessions. If you remove a user from the Shopify application in your identity provider, they can still access Shopify for up to 14 days, per Shopify's SAML page.
The FAQ this post syndicates, with each claim tied to its Shopify source, is at Does Shopify Plus support SCIM user provisioning?
Our content is AI-generated and fact-checked against official Shopify sources.
Top comments (0)