{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/bitwarden-scim-staged-users-invitation-policy-boundary/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/",
        "slug": "bitwarden-scim-staged-users-invitation-policy-boundary",
        "url": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/bitwarden-scim-staged-users-invitation-policy-boundary/"
        },
        "title": "Distinguish staged Bitwarden SCIM records from invited organization members",
        "summary": "A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:51+00:00",
        "modified_at": "2026-10-15T13:36:17+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 269,
        "potentially_affected": "This concerns Bitwarden SCIM provisioning and invitation state on supported organization plans. Provisioning a record is separate from authentication, vault decryption, and assignment of access to collection data.",
        "dse_recommendation": "DSE recommends tracking the onboarding sequence from source-directory assignment through staged record, invitation, acceptance, confirmation, and intended collection access.",
        "primary_source": {
            "name": "Bitwarden — About SCIM",
            "url": "https://bitwarden.com/help/about-scim/",
            "published_on": null,
            "authority": "bitwarden.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.</p>\n<h2>Source facts</h2>\n<p>Bitwarden SCIM can provision and deprovision organization members and groups from an identity provider using a SCIM endpoint and API key. By default, newly provisioned users enter Staged status rather than receiving an immediate invitation. The Automatically send email invitations setting changes that behavior. Staged users receive no invitation email, do not occupy a license seat, and are not subject to organization policies. The documentation also warns administrators to turn off Directory Connector before enabling SCIM when migrating from that provisioning method.</p>\n<p>Source: <a href=\"https://bitwarden.com/help/about-scim/\">Bitwarden — About SCIM</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns Bitwarden SCIM provisioning and invitation state on supported organization plans. Provisioning a record is separate from authentication, vault decryption, and assignment of access to collection data.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends tracking the onboarding sequence from source-directory assignment through staged record, invitation, acceptance, confirmation, and intended collection access. Decide whether automatic invitations fit the organization’s joiner process before enabling them. Give helpdesk staff a status-based troubleshooting guide so they do not repeatedly recreate a user whose record is simply staged. During a migration, designate one provisioning authority and retire the previous synchronization job deliberately. Keep the SCIM key in approved secret storage and record its operational owner.</p>\n<h2>Verification</h2>\n<p>Provision a test user with automatic invitations disabled and confirm the staged state and lack of invitation. Then exercise the approved invitation path and check the final collection access. Review the old connector schedule during a SCIM migration to verify that competing synchronization is no longer running.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://bitwarden.com/help/about-scim/\">Bitwarden — About SCIM</a>. Reviewed October 15, 2026.</p>",
        "content_text": "A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.\nSource facts\nBitwarden SCIM can provision and deprovision organization members and groups from an identity provider using a SCIM endpoint and API key. By default, newly provisioned users enter Staged status rather than receiving an immediate invitation. The Automatically send email invitations setting changes that behavior. Staged users receive no invitation email, do not occupy a license seat, and are not subject to organization policies. The documentation also warns administrators to turn off Directory Connector before enabling SCIM when migrating from that provisioning method.\nSource: Bitwarden — About SCIM.\nApplicability\nThis concerns Bitwarden SCIM provisioning and invitation state on supported organization plans. Provisioning a record is separate from authentication, vault decryption, and assignment of access to collection data.\nDSE recommendation\nDSE recommends tracking the onboarding sequence from source-directory assignment through staged record, invitation, acceptance, confirmation, and intended collection access. Decide whether automatic invitations fit the organization’s joiner process before enabling them. Give helpdesk staff a status-based troubleshooting guide so they do not repeatedly recreate a user whose record is simply staged. During a migration, designate one provisioning authority and retire the previous synchronization job deliberately. Keep the SCIM key in approved secret storage and record its operational owner.\nVerification\nProvision a test user with automatic invitations disabled and confirm the staged state and lack of invitation. Then exercise the approved invitation path and check the final collection access. Review the old connector schedule during a SCIM migration to verify that competing synchronization is no longer running.\nOfficial reference\nBitwarden — About SCIM. Reviewed October 15, 2026.",
        "content_markdown": "A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.\n\n## Source facts\n\nBitwarden SCIM can provision and deprovision organization members and groups from an identity provider using a SCIM endpoint and API key. By default, newly provisioned users enter Staged status rather than receiving an immediate invitation. The Automatically send email invitations setting changes that behavior. Staged users receive no invitation email, do not occupy a license seat, and are not subject to organization policies. The documentation also warns administrators to turn off Directory Connector before enabling SCIM when migrating from that provisioning method.\n\nSource: [Bitwarden — About SCIM](https://bitwarden.com/help/about-scim/).\n\n## Applicability\n\nThis concerns Bitwarden SCIM provisioning and invitation state on supported organization plans. Provisioning a record is separate from authentication, vault decryption, and assignment of access to collection data.\n\n## DSE recommendation\n\nDSE recommends tracking the onboarding sequence from source-directory assignment through staged record, invitation, acceptance, confirmation, and intended collection access. Decide whether automatic invitations fit the organization’s joiner process before enabling them. Give helpdesk staff a status-based troubleshooting guide so they do not repeatedly recreate a user whose record is simply staged. During a migration, designate one provisioning authority and retire the previous synchronization job deliberately. Keep the SCIM key in approved secret storage and record its operational owner.\n\n## Verification\n\nProvision a test user with automatic invitations disabled and confirm the staged state and lack of invitation. Then exercise the approved invitation path and check the final collection access. Review the old connector schedule during a SCIM migration to verify that competing synchronization is no longer running.\n\n## Official reference\n\n[Bitwarden — About SCIM](https://bitwarden.com/help/about-scim/). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/",
                "url": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Distinguish staged Bitwarden SCIM records from invited organization members",
                        "item": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/#article",
                "identifier": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/",
                "url": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/",
                "headline": "Distinguish staged Bitwarden SCIM records from invited organization members",
                "description": "A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.",
                "abstract": "A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.",
                "articleBody": "A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.\nSource facts\nBitwarden SCIM can provision and deprovision organization members and groups from an identity provider using a SCIM endpoint and API key. By default, newly provisioned users enter Staged status rather than receiving an immediate invitation. The Automatically send email invitations setting changes that behavior. Staged users receive no invitation email, do not occupy a license seat, and are not subject to organization policies. The documentation also warns administrators to turn off Directory Connector before enabling SCIM when migrating from that provisioning method.\nSource: Bitwarden — About SCIM.\nApplicability\nThis concerns Bitwarden SCIM provisioning and invitation state on supported organization plans. Provisioning a record is separate from authentication, vault decryption, and assignment of access to collection data.\nDSE recommendation\nDSE recommends tracking the onboarding sequence from source-directory assignment through staged record, invitation, acceptance, confirmation, and intended collection access. Decide whether automatic invitations fit the organization’s joiner process before enabling them. Give helpdesk staff a status-based troubleshooting guide so they do not repeatedly recreate a user whose record is simply staged. During a migration, designate one provisioning authority and retire the previous synchronization job deliberately. Keep the SCIM key in approved secret storage and record its operational owner.\nVerification\nProvision a test user with automatic invitations disabled and confirm the staged state and lack of invitation. Then exercise the approved invitation path and check the final collection access. Review the old connector schedule during a SCIM migration to verify that competing synchronization is no longer running.\nOfficial reference\nBitwarden — About SCIM. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:51+00:00",
                "dateModified": "2026-10-15T13:36:17+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/bitwarden-scim-staged-users-invitation-policy-boundary/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Distinguish staged Bitwarden SCIM records from invited organization members"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 269,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Bitwarden — About SCIM",
                    "url": "https://bitwarden.com/help/about-scim/"
                }
            }
        ]
    }
}