---
title: SCIM certified provisioners
description: You can use a SCIM connection to enable outbound provisioning from PingOne to a ZScaler ZPA account.
component: pingone
page_id: pingone:integrations:p1_scim_certified_provisioners
canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_scim_certified_provisioners.html
page_aliases: ["provisioning_zscaler_zpa_using_scim.adoc", "p1_provisioning_zscaler_zia_using_scim.adoc"]
section_ids:
  p1_scim_zpa: Provisioning ZScaler ZPA with SCIM using PingOne
  before-you-begin: Before you begin
  steps: Steps
  p1_scim_zia: Provisioning ZScaler ZIA with SCIM using PingOne
  before-you-begin-2: Before you begin
  steps-2: Steps
---

# SCIM certified provisioners

You can use a SCIM connection to enable outbound provisioning from PingOne and provision users and groups to your accounts.

The following are SCIM certified provisioners:

* [ZScaler Private Access (ZPA)](#p1_scim_zpa): A zero trust network access (ZTNA) solution that enables secure, seamless, and identity-based access to internal applications without placing users on the network.

* [Zscaler Internet Access (ZIA)](#p1_scim_zia): A secure internet and web gateway that provides users with safe, fast, and direct access to the internet by inspecting and enforcing policies on all internet-bound traffic.

## Provisioning ZScaler ZPA with SCIM using PingOne

You can use a SCIM connection in PingOne to provision users and groups to your ZScaler Private Access (ZPA) account.

ZScaler ZPA is a zero trust network access (ZTNA) solution that enables secure, seamless, and identity-based access to internal applications without placing users on the network.

### Before you begin

Make sure that you have:

* A ZScaler ZPA administrator account. Learn more on the [ZScaler website](https://www.zscaler.com/) or [contact ZScaler sales](https://www.zscaler.com/company/contact).

* Users created and assigned to a group specifically for ZScaler ZPA provisioning in PingOne. Learn more in [Adding a user](../directory/p1_adduser.html) and [Managing groups](../directory/p1_managing_groups.html).

### Steps

1. In the PingOne admin console, [Create a SCIM provisioning connection](p1_create_scim_connection.html) to ZScaler ZPA.

   Configure the SCIM connection with the following values specific to your ZScaler ZPA account:

   * **Name**: Enter a name for your connection, such as `ZScaler ZPA SCIM Provisioning`.

   * (Optional) **Description**: Enter a description for your ZScaler ZPA provisioning connection.

   * **SCIM Base URL**: Enter the full URL of your ZScaler ZPA SCIM endpoint, such as `https://zscaler-zpa-example.com/v2/`.

   * **Authentication Method**: Select **OAuth 2 Bearer Token**.

   * **OAuth Access Token**: Enter the SCIM API token provided by ZScaler ZPA.

   * In the **Actions** section, ensure the following options remain selected:

     * **Enable users creation**

     * **Enable users updation**

     * **Enable users disable**

     * **Enable users deprovision**

2. [Create an outbound rule](p1_create_provisioning_rule_outbound.html) and select the ZScaler ZPA connection as the target. This is also when you can add a user filter and attribute mapping.

   |   |                                                                                              |
   | - | -------------------------------------------------------------------------------------------- |
   |   | The **Username** attribute used for ZScaler ZPA sign-on must be in **email address** format. |

3. [Configure outbound group provisioning](p1_provisioning_configuring_outbound_group_provisioning.html) and add the groups you created in PingOne for ZScaler ZPA.

4. Confirm users and groups are successfully provisioned to ZScaler ZPA. [View the sync status](p1_view_sync_status.html) to review synchronization results and any errors. You can find examples in [Outbound provisioning sync summary examples](p1_outbound_group_provisioning_sync_summary_examples.html).

## Provisioning ZScaler ZIA with SCIM using PingOne

You can use a SCIM connection in PingOne to provision users and groups to your ZScaler Internet Access (ZIA) account.

ZScaler ZIA is a secure internet and web gateway that provides users with safe, fast, and direct access to the internet by inspecting and enforcing policies on all internet-bound traffic.

### Before you begin

Make sure that you have:

* A ZScaler ZIA administrator account. Learn more on the [ZScaler website](https://www.zscaler.com/) or [contact ZScaler sales](https://www.zscaler.com/company/contact).

* Users created and assigned to a group specifically for ZScaler ZIA provisioning in PingOne. Learn more in [Adding a user](../directory/p1_adduser.html) and [Managing groups](../directory/p1_managing_groups.html).

### Steps

1. In the PingOne admin console, [Create a SCIM provisioning connection](p1_create_scim_connection.html) to ZScaler ZIA.

   Enter the following configurations that apply to your ZScaler ZIA account:

   * **Name**: Enter a name for your connection, such as `ZScaler ZIA SCIM Provisioning`.

   * (Optional) **Description**: Enter a description for your ZScaler ZIA provisioning connection.

   * **SCIM Base URL**: Enter the full URL of your ZScaler ZIA SCIM endpoint, such as `https://zscaler-zia-example.com/v2/`.

   * **Authentication Method**: Select **OAuth 2 Bearer Token**.

   * **OAuth Access Token**: Enter the SCIM API token provided by ZScaler ZIA.

   * In the **Actions** section, ensure the following options remain selected:

     * **Allow Users to be Created**

     * **Allow Users to be Updated**

     * **Allow Users to be Disabled**

     * **Allow Users to be Deprovisioned**

2. [Create an outbound rule](p1_create_provisioning_rule_outbound.html) and select the ZScaler ZIA connection as the target. This is also when you can add a user filter and attribute mapping.

   |   |                                                                                              |
   | - | -------------------------------------------------------------------------------------------- |
   |   | The **Username** attribute used for ZScaler ZIA sign-on must be in **email address** format. |

3. [Configure outbound group provisioning](p1_provisioning_configuring_outbound_group_provisioning.html) and add the groups you created in PingOne for ZScaler ZIA.

4. Confirm users and groups are successfully provisioned to ZScaler ZIA. [View the sync status](p1_view_sync_status.html) to review synchronization results and any errors. You can find examples in [Outbound provisioning sync summary examples](p1_outbound_group_provisioning_sync_summary_examples.html).