# SCIM Deprovisioning Is a Promise Your App Probably Breaks

DevFeed: [SCIM Deprovisioning Is a Promise Your App Probably Breaks](<https://devfeed.tech/articles/scim-deprovisioning-is-a-promise-your-app-probably-breaks-16056.md>)

Original publisher: [Read original article](<https://workos.com/blog/scim-deprovisioning-promise-your-app-breaks>)

Author: WorkOS

Published: 2026-08-06T01:29:36Z

Content type: article

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [API](<https://devfeed.tech/topics/api.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [JSON](<https://devfeed.tech/topics/json.md>), [Internet Engineering Task Force (IETF)](<https://devfeed.tech/topics/ietf.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [http](<https://devfeed.tech/tags/http.md>), [identity](<https://devfeed.tech/tags/identity.md>), [idp](<https://devfeed.tech/tags/idp.md>), [ietf](<https://devfeed.tech/tags/ietf.md>), [json](<https://devfeed.tech/tags/json.md>), [net-conf](<https://devfeed.tech/tags/net-conf.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [schema](<https://devfeed.tech/tags/schema.md>), [security](<https://devfeed.tech/tags/security.md>), [standards](<https://devfeed.tech/tags/standards.md>), [state](<https://devfeed.tech/tags/state.md>), [token](<https://devfeed.tech/tags/token.md>)

## AI overview

This article explains that SCIM deprovisioning updates identity state but does not automatically invalidate an application's sessions, refresh tokens, or API keys. It describes how identity providers commonly use soft deactivation and why applications must explicitly handle the resulting offboarding state.

## Source excerpt

SCIM tells you a user is gone, but sessions, refresh tokens, and API keys often outlive deprovisioning. Here's why offboarding needs more than a user row.