Bringing an organisation's own directory: identity binding with SCIM
An organisation's directory already knows who works there and in what role. Essence follows it, provisioning people through SCIM and keeping the credentials issued to them in step with it.
An employee moves from finance to sales, and the organisation's directory is updated the same day. The credential the organisation issued to that employee, stating their department, still says finance. It will go on saying so until someone remembers to change it.
Every organisation already keeps a record of who works there, in which team and in what role. A platform that asks for a second copy, kept up to date by hand, drifts from the first. On the Essence platform the organisation's directory stays the source of truth, and the platform follows it.
Who belongs: provisioning from the directory
Since our July release, an organisation can connect its directory to Essence using SCIM, a standard protocol for directory provisioning. The directory sends its people and whether each one is active, and nobody has to enter them again.
An administrator can look a person up by email to see how far their provisioning has got, and retry it if it is stuck. That answers a common support question. If single sign-on is switched on before a new joiner has been provisioned, the joiner can sign in and land on a pending state, and the administrator can see why and act on it.
Since our September release, the provisioning record keeps what the directory said about whether a person is active apart from what Essence did with that message. An administrator can tell a person who is waiting because the organisation does not provision automatically from a person the directory has deactivated, and deal with each correctly.
What a credential does when the directory changes
Identity binding, added in our September release, links a person in the directory to the credentials issued to them. A binding holds only references and policy. When the directory reports a change to an attribute that a credential depends on, such as a department, the organisation's policy decides what happens: reissue the credential, revoke one claim within it, suspend it, or revoke it.
Some rules hold whatever the policy says:
- Leaving always suspends. When the directory marks someone inactive, every binding for that person is suspended. A policy that tries to ignore a leaver cannot be saved.
- Silence is not leaving. If a directory stops sending updates beyond the agreed interval, its bindings are marked stale and an alert is raised. Nothing is revoked or suspended on silence alone.
- No hidden full revoke. If a credential type cannot carry status for one claim at a time, a policy that asks to revoke one claim is refused when it is saved, with a reason. It is never quietly turned into a full revoke.
- Preview before save. An administrator is shown which claims would change and which action would fire before a policy can be saved.
- Gaps are visible. A change to a linked attribute with no policy entry shows up as a gap for the administrator to close.
- One change, one action. A directory message delivered twice produces one reissue or one revocation, not two.
The person holding the credential gets a plain-language notice when it is reissued, has a claim revoked, is suspended or is revoked. The notice does not include the changed value or the organisation's business reason.
What binding does not keep
Identity binding does not store, publish in an event or write to a log any attribute value from the directory, any decentralised identifier document or any credential body. Where it needs to notice that a value has changed, it keeps a fingerprint. The same value in two bindings produces two different fingerprints, so bindings cannot be matched against each other.
One organisation's directory connection cannot read or change another organisation's bindings. An attempt reads as if the binding does not exist.
The approach draws on an IETF extension to SCIM for linking directory entries to credentials, published as an Internet-Draft, and we follow that work as it develops.
If you run identity for an organisation, this means you maintain your people once, in the directory you already run, and the credentials issued to them keep up under a policy you set. If your organisation issues credentials to its people, we would be glad to show you how your directory would connect.
Published 20 October 2026