Distinguish staged Bitwarden SCIM records from invited organization members

A synchronized staged record does not yet receive an invitation, occupy a seat, or inherit policies.

Source facts

Bitwarden SCIM can provision and deprovision organization members and groups from an identity provider using a SCIM endpoint and API key. By default, newly provisioned users enter Staged status rather than receiving an immediate invitation. The Automatically send email invitations setting changes that behavior. Staged users receive no invitation email, do not occupy a license seat, and are not subject to organization policies. The documentation also warns administrators to turn off Directory Connector before enabling SCIM when migrating from that provisioning method.

Source: Bitwarden — About SCIM.

Applicability

This concerns Bitwarden SCIM provisioning and invitation state on supported organization plans. Provisioning a record is separate from authentication, vault decryption, and assignment of access to collection data.

DSE recommendation

DSE recommends tracking the onboarding sequence from source-directory assignment through staged record, invitation, acceptance, confirmation, and intended collection access. Decide whether automatic invitations fit the organization’s joiner process before enabling them. Give helpdesk staff a status-based troubleshooting guide so they do not repeatedly recreate a user whose record is simply staged. During a migration, designate one provisioning authority and retire the previous synchronization job deliberately. Keep the SCIM key in approved secret storage and record its operational owner.

Verification

Provision a test user with automatic invitations disabled and confirm the staged state and lack of invitation. Then exercise the approved invitation path and check the final collection access. Review the old connector schedule during a SCIM migration to verify that competing synchronization is no longer running.

Official reference

Bitwarden — About SCIM. Reviewed October 15, 2026.