Overview
SCIM provisioning automatically creates, updates, and deactivates your Cyberready employee accounts based on changes you make in PingOne. Once configured, you no longer need to manually add, edit, or remove employees in Cyberready - PingOne keeps Cyberready in sync with your organization's identity source on an ongoing basis.
This matters because manual user management is slow and error-prone, and delayed offboarding is a security risk. With SCIM provisioning in place, a new hire added to PingOne is automatically available in Cyberready, and an employee you disable in PingOne is automatically deactivated in Cyberready.
In this integration, PingOne sends (pushes) user and group data to Cyberready. You do not need to configure anything on Cyberready's side to pull data - Cyberready simply receives what PingOne sends.
Prerequisites
Before you begin, confirm you have:
Administrator access in PingOne, with permission to configure Integrations > Provisioning.
Administrator access in Cyberready, with permission to access Company Management > Employees.
Every PingOne user you plan to provision has a Username attribute formatted as a valid email address (for example,
[email protected]). Cyberready rejects any username that is not a valid email address, so confirm this before you proceed.
Step-by-Step Instructions
Step 1: Generate your SCIM credentials in Cyberready
In Cyberready, go to Company Management > Employees.
Click Import, then select SCIM.
In the window that opens, toggle on Enable SCIM Provisioning.
Click Generate token.
Copy the Webhook URL and the Token shown. You will enter both of these into PingOne in Step 3.
Keep this window open in a separate tab. You will return to it in Step 6.
Step 2: Create a new SCIM connection in PingOne
In the PingOne admin console, go to Integrations > Provisioning.
Click +, then select New Connection.
Next to Identity Store, click Select.
Select the SCIM Outbound tile, then click Next.
Enter a Name (for example,
Cyberready SCIM Provisioning) and a Description.
Click Next.
Step 3: Configure the connection
On the Configure Authentication screen, enter the following:
Field | What to enter |
SCIM Base URL | The Webhook URL you copied from Cyberready in Step 1 |
Users Resource |
|
Groups Resource |
|
SCIM Version |
|
Authentication Method | OAuth 2 Bearer Token |
OAuth Access Token | The Token you copied from Cyberready in Step 1 |
Auth Type Header | Bearer |
Click Test Connection.
Expected result: a Connection Successful message appears. If it does not, see Common Issues & Troubleshooting below before continuing.
Step 4: Set your provisioning preferences
On the same screen, configure the following:
User Filter Expression: leave this at its default value,
userName Eq "%s".User Identifier: leave this at its default value,
userName.Group Membership Handling: select Merge.
Enable users creation: turn this on.
Enable users updation: turn this on. A new option, Enable users disable, will appear — turn this on as well.
Enable users deprovision: turn this on. Set Remove Action to Disable.
Important: Set Remove Action to Disable, not Delete. If a user is removed from PingOne's directory entirely, PingOne cannot notify Cyberready of the removal, and the account will remain active in Cyberready indefinitely. Disabling a user, rather than deleting them, is the only deprovisioning method that reliably updates Cyberready. See Best Practices below.
Click Save. Then, at the top of the connection panel, turn the connection on using the toggle switch.
Step 5: Create a provisioning rule and map your attributes
Creating the connection does not start provisioning on its own. You also need a rule that tells PingOne which users to send and how their fields map to Cyberready.
On the Provisioning page, click the Rules tab.
Click +, then select New Rule.
Confirm PingOne is set as the source, and select your Cyberready connection as the target.
Enter a Name (for example,
Cyberready SCIM Outbound Rule) and a Description.
Under Directory Configuration, set a User Filter to define which PingOne users are provisioned. Click 'Add Condition '. You can filter by population, group, or another attribute.
If you want to provision group membership as well, add the relevant Groups.
On the Attribute Mapping screen, confirm the following fields are mapped:
PingOne attribute | Cyberready attribute |
Username |
|
Email Address |
|
Given Name |
|
Family Name |
|
Primary Phone |
|
Enabled |
|
Note: If you cannot guarantee every user's PingOne Username is formatted as an email address, map Email Address to userName instead of Username. This ensures the value Cyberready receives is always a valid email, regardless of how Username is set for any individual user.
8. Click Save.
Step 6: Activate provisioning in Cyberready
PingOne can now send data to Cyberready, but Cyberready will not create or display any records until you complete this step.
Return to the Cyberready SCIM window from Step 1.
Once Cyberready confirms it has received a signal from PingOne, click Start Provisioning.
Click Continue.
Confirm the integration now appears in your Cyberready connectors list.
Step 7: Turn on the provisioning rule
In PingOne, open your rule and turn it on using the toggle at the top of the panel. PingOne will begin sending users and groups that match your filter to Cyberready.
Validation / Expected Outcome
To confirm provisioning is working:
In PingOne, open your rule's Overview tab and check the User Sync Summary and Group Sync Summary. You should see a Success count matching the number of users and groups in scope.
In Cyberready, go to Company Management > Employees. Your provisioned users should appear with the correct name, email, and an Active status.
If you provisioned groups, go to Company Management > User Groups and confirm membership matches PingOne.
If any of these do not match what you expect, see Common Issues & Troubleshooting below.
Common Issues & Troubleshooting
Test Connection fails: Confirm the SCIM Base URL exactly matches the Webhook URL shown in Cyberready, with no extra spaces or characters. Confirm the Token was copied in full. If the issue persists, generate a new token in Cyberready and enter it again in PingOne.
A user fails to sync, and the error includes [SCIM004] Bad request: This means the user's Username attribute in PingOne is not a valid email address. Cyberready requires the value mapped to userName to be email-formatted. Update the user's Username in PingOne, or change your attribute mapping to use Email Address instead (see Step 5).
Users report success in PingOne but do not appear in Cyberready: Confirm you completed Step 6. Cyberready does not process or display any data sent before you click Start Provisioning and Continue.
A user you removed from PingOne still shows as Active in Cyberready: This happens if the user was deleted from PingOne's directory rather than disabled. Disable the user in PingOne going forward — this reliably deactivates the corresponding account in Cyberready. If a user is only disabled (not deleted) and still shows Active in Cyberready, turn your provisioning rule off and back on in PingOne to force a new sync.
Best Practices
Always disable users in PingOne before removing them, rather than deleting their PingOne account directly. This is the only method that reliably deactivates the corresponding user in Cyberready.
Map Email Address to
userNamein your attribute mapping if your organization does not enforce email-formatted usernames across all PingOne users.Test with a small group of users first. Scope your provisioning rule's User Filter to a single test population or group before rolling it out to your full directory, so you can confirm attribute mapping and sync behavior before it affects your entire organization.
Review the User Sync Summary after every configuration change. This gives you an immediate, per-user view of what succeeded or failed, rather than waiting for a user to report a problem.