---
title: "Provisioning — Clock Clerk user guide"
description: "The Provisioning tab under Settings in Clock Clerk: the SCIM tokens that let your identity provider add, update and remove people, on the Enterprise plan."
url: "https://clockclerk.com/guide/screens/admin-provisioning"
---

Screens

# Provisioning

The SCIM tokens that let your organization's identity provider, such as Okta or Microsoft Entra ID, add people to Clock Clerk, keep their details up to date and remove them when they leave. There are three ways people arrive in an organization: found in your Microsoft directory, sent by your identity provider over SCIM, or added by hand on [People](https://clockclerk.com/guide/screens/admin-people.md). This page is about the second; [Provision people from Okta or Entra ID](https://clockclerk.com/guide/workflows/provision-people.md) walks through setting up each provider and how the three ways fit together.

## Who sees it

Administrators only, on the Enterprise plan: it is **Provisioning** under **Settings** in the menu, at [/admin/provisioning](https://app.clockclerk.com/admin/provisioning). On any other plan the menu leaves it out, and the address says *You don't have access to this area*, as it does to anyone who is not an administrator.

Tokens created on Enterprise are kept if the organization moves to another plan, but they stop working until it is on Enterprise again.

## The SCIM address

At the top, beside a short note, is the **SCIM address**: the address your identity provider sends its requests to. Okta calls it the *SCIM connector base URL* and Microsoft Entra ID the *Tenant URL*. **Copy** puts it on the clipboard.

## Creating a token

1. Choose **New token**.
2. Give it a **Name**, usually the identity provider it is for, so you can tell it apart later.
3. Choose **Create token**. **Copy your token now** shows the token once. **Copy** puts it on the clipboard.
4. Enter it in your identity provider's provisioning settings, where Okta and Microsoft Entra ID ask for an API token or a secret token, together with the SCIM address (see Setting up your identity provider).
5. Choose **Done**.

Clock Clerk keeps only a fingerprint of the token, never the token itself, so nobody can show it to you again. If it is lost, create another and revoke the old one.

## The tokens

The table lists every token your organization holds, newest first:

- **Token**: the name it was given.
- **Ends in**: its last four characters, to match it with the one your identity provider holds.
- **Created**: the date, and the administrator who created it.
- **Last used**: when your identity provider last used it, to within a few minutes, or *Never*.

A screen with no tokens says *No tokens yet*, and people are added on [People](https://clockclerk.com/guide/screens/admin-people.md) until you create one.

## Revoking a token

**Revoke** asks **Revoke this token?**, and **Revoke token** deletes it. The identity provider using it is refused from its next request. People it already added stay in the organization.

## Setting up your identity provider

With the address and a token, the rest happens at your provider: turning provisioning on for the app, entering both, choosing which attributes it sends, and assigning the people it should send. [Provisioning from Okta](https://clockclerk.com/guide/workflows/provision-people.md) and [Provisioning from Microsoft Entra ID](https://clockclerk.com/guide/workflows/provision-people.md) have the steps. Deactivating somebody at the provider sets their **Left** date in Clock Clerk, so their access ends and everything they did is kept (see [What deactivating somebody does](https://clockclerk.com/guide/workflows/provision-people.md)).

## Buttons and when they appear

| Button | What it does | When you have it |
| --- | --- | --- |
| New token | Opens **New SCIM token**. **Create token** is disabled until it has a name. | Always. Disabled while your organization is read-only. |
| Copy | Puts the SCIM address, or a token just created, on the clipboard. | Always. |
| Revoke | Asks **Revoke this token?**, then **Revoke token** deletes it. | On every row, unless your organization is read-only. |

Each change is checked again when you press it: only an administrator, on the Enterprise plan, can create or revoke a token (see [Roles](https://clockclerk.com/guide/roles.md)).