Skip to main content
Triggr works with the users and teams in one node of a Keeper Enterprise tenant, yours or a managed company’s: provisioning, updating, locking and deactivating users, and managing teams. To manage Keeper MSP accounts as a distributor, use Keeper MSP instead.

​
Set up Keeper SCIM

You need admin rights to add provisioning methods in the tenant’s Keeper Admin Console (for a managed company, the Manage Companies permission in your Keeper MSP console). Users’ email domains must be reserved to the tenant.
1

Open the node

In the Admin Console, go to Admin and select the node Triggr should provision into. It must be below the root node, and sub-nodes aren’t included.
2

Add a SCIM method

On the node’s Provisioning tab, click Add Method, select SCIM (System for Cross-Domain Identity Management) and click Next.
3

Generate the token and save

Click Create Provisioning Token (or Generate), copy the URL and token, then click Save. The token only works once the method is saved, and the method then shows as Pending.
The URL has the form https://<region host>/api/rest/scim/v2/<node ID>. Keeper Commander’s scim create --node="<node name>" prints the same URL and token; the node ID is the number at the end of the URL, not the separate SCIM ID Commander also prints. See Keeper’s API Provisioning with SCIM.

​
Connect it in Triggr

1

Open the integration

Go to Integrations > Keeper SCIM and click Configure on the Base Configuration card.
The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.
2

Enter the node and token

Select the Region host from your URL, enter the digits at the end of the URL as SCIM Node ID, paste the SCIM Bearer Token and click Save Configuration.
The Keeper SCIM configuration window with a Region host dropdown, SCIM Node ID and SCIM Bearer Token fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.
One connection covers one node. To connect a different node, click Edit and enter its details.

​
How Keeper handles changes

  • New users are invited by email. Set userName to the user’s email address.
  • New teams and team memberships wait for approval by an administrator, a team member, Keeper Commander or Keeper Automator.
  • Deactivate User locks the account rather than deleting it.
  • List actions return 1,000 results by default; page with startIndex and count. Bodies use SCIM JSON, as in Keeper’s Using SCIM API Provisioning.

​
Troubleshooting

Check the token was pasted in full, the method was saved in the Admin Console, and Region host and SCIM Node ID match the URL. To get a new token, run scim edit <SCIM ID> in Keeper Commander.
The email is already used in another Keeper tenant or node. For a user in this tenant, move them into the SCIM node in the Admin Console first.
The tenant has no licensed seats left. Add licences or free up seats.
It’s waiting for approval, or the user’s email domain isn’t reserved to the tenant.