Cloudflare Adds Full‑State SCIM Group Replacement via HTTP PUT

by

What’s new

Cloudflare announced that its SCIM 2.0 provisioning now supports group replacement via HTTP PUT, following the semantics defined in RFC 7644 §3.5.1. This change lets an identity provider send a single request that fully describes a group’s current state—display name, external identifier, and member list—so Cloudflare can replace the existing group with the supplied definition.

Why it matters

Many enterprise identity solutions use a “replace‑the‑whole‑object” model when synchronizing groups. Prior to this update, Cloudflare only accepted incremental changes (add/remove members) via PATCH, which could cause drift if the source system performed a full replace. The new PUT‑based workflow eliminates that mismatch, improving consistency between the source IdP and Cloudflare’s access control groups.

Who can use it

SCIM provisioning for the Cloudflare dashboard is limited to Enterprise‑tier customers. Additionally, only users with the Super Administrator role can complete the initial SCIM setup.

Getting started

To take advantage of the feature, administrators should:

  1. Verify that the account is on the Enterprise plan and that you have Super Administrator privileges.
  2. Configure the IdP’s SCIM endpoint to use HTTP PUT for group resources, following the standard SCIM schema.
  3. Test the integration by sending a PUT request that includes displayName, externalId, and a full members array.

For detailed steps, see Cloudflare’s SCIM provisioning overview.