This message was deleted.

SSO Compatibility Yes, API-created users can authenticate through SSO when configured later . When "Convert existing user to SSO" is enabled, Descope automatically merges incoming SSO users with existing users if the login ID or email matches and the user belongs to exactly one tenant . SCIM User Matching SCIM matches existing users based on login ID or email . When SCIM provisions a user that already exists in Descope, it merges with the existing user rather than creating a duplicate, provided the matching conditions are met . SCIM updates are applied to user sessions the next time they log in or refresh their session token . Groups and Tenant Roles API-created users have full parity with SSO/SCIM-provisioned users for group membership and role assignments . You can assign tenant roles using the Update User Add Roles endpoint, and users can be added to tenants with specific role configurations during creation or afterward . There are no limitations on group membership based on how the user was originally created . Merging SSO Identities Risk | Descope Documentation SCIM Management | Descope Documentation Update User Remove Tenant | API Reference | Descope Documentation Patch User | API Reference | Descope Documentation Update User Add Tenant | API Reference | Descope Documentation

if i understand correctly, there are no restrictions, i can create users and then add scim/sso, and it will work regularly right? did i miss sioething?

Hi, I'm Descope's AI assistant. Correct Understanding Yes, you understand correctly. There are no restrictions on creating users via Management API first, then adding SSO/SCIM later. The flow works seamlessly. Key Requirements For successful merging, you need: 1. "Convert existing user to SSO" enabled in tenant settings 2. Matching identifiers - the SSO/SCIM user's login ID or email must match your API-created user 3. Single tenant membership - the existing user must belong to exactly one tenant What You Didn't Miss The process is straightforward - no special preparation needed for API-created users. They merge automatically when conditions are met, and all functionality (groups, roles, permissions) works identically regardless of creation method. Merging SSO Identities Risk | Descope Documentation