From 5c11edf1dfe00d81685c05115f27643f7c711947 Mon Sep 17 00:00:00 2001 From: Muhammadsaeed707 Date: Wed, 24 Jun 2026 09:15:35 -0800 Subject: [PATCH 1/2] add service account consideration --- docs/hub/enterprise-scim.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/hub/enterprise-scim.md b/docs/hub/enterprise-scim.md index 9ff5dd96c8..a3e6eb6fa3 100644 --- a/docs/hub/enterprise-scim.md +++ b/docs/hub/enterprise-scim.md @@ -67,11 +67,14 @@ Once a SCIM group is linked to a Resource Group: ### SCIM-managed Resource Groups -A Resource Group linked to a SCIM group is considered **SCIM-managed**. The IdP is the sole source of truth for its membership. As a result: +A Resource Group linked to a SCIM group is considered **SCIM-managed**. The IdP is the sole source of truth for its regular members. As a result: -- Manual membership changes via the Hub UI or API are **blocked** — any attempt to add, remove, or change a member's role on a SCIM-managed Resource Group will return a `403` error. +- Manual membership changes via the Hub UI or API are **blocked** for regular users — any attempt to add, remove, or change the role of a regular user on a SCIM-managed Resource Group will return a `403` error. +- [Service accounts](./enterprise-service-accounts) are the exception: since they are never provisioned through SCIM, you can still add, remove, or change the role of a service account manually on a SCIM-managed Resource Group. - Auto-join **cannot be enabled** on a SCIM-managed Resource Group. To re-enable auto-join, first remove the SCIM link. +In the Resource Group settings, a SCIM-managed Resource Group displays a **SCIM synced** badge, and the membership form notes that only service accounts can be added or removed manually. + Group provisioning works the same way for both Basic SSO and Managed SSO. ## Supported user attributes From 22d88db64c77787c8ce93eee9e8b0a4db5ca975e Mon Sep 17 00:00:00 2001 From: Muhammad Saeed <48301600+Muhammadsaeed707@users.noreply.github.com> Date: Tue, 30 Jun 2026 10:39:11 -0400 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/hub/enterprise-scim.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/hub/enterprise-scim.md b/docs/hub/enterprise-scim.md index a3e6eb6fa3..e2bfe832d5 100644 --- a/docs/hub/enterprise-scim.md +++ b/docs/hub/enterprise-scim.md @@ -67,7 +67,7 @@ Once a SCIM group is linked to a Resource Group: ### SCIM-managed Resource Groups -A Resource Group linked to a SCIM group is considered **SCIM-managed**. The IdP is the sole source of truth for its regular members. As a result: +A Resource Group linked to a SCIM group is considered **SCIM-managed**. The IdP is the sole source of truth for its regular users. As a result: - Manual membership changes via the Hub UI or API are **blocked** for regular users — any attempt to add, remove, or change the role of a regular user on a SCIM-managed Resource Group will return a `403` error. - [Service accounts](./enterprise-service-accounts) are the exception: since they are never provisioned through SCIM, you can still add, remove, or change the role of a service account manually on a SCIM-managed Resource Group.