# SCIM Realm API as an Experimental Feature

DevFeed: [SCIM Realm API as an Experimental Feature](<https://devfeed.tech/articles/scim-realm-api-as-an-experimental-feature-31770.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/04/scim-as-experimental-feature>)

Author: Keycloak Core IAM Team

Published: 2026-04-10T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [API](<https://devfeed.tech/topics/api.md>), [IAM](<https://devfeed.tech/topics/iam.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [Provisioning](<https://devfeed.tech/topics/provisioning.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [entra-id](<https://devfeed.tech/tags/entra-id.md>), [experimental](<https://devfeed.tech/tags/experimental.md>), [feature](<https://devfeed.tech/tags/feature.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [provisioning](<https://devfeed.tech/tags/provisioning.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak 26.6 introduces the SCIM Realm API as an experimental feature. It enables clients using the SCIM protocol to manage users and groups, with compatibility work focused on Microsoft Entra ID. The article also explains how to enable and try the API.

## Source excerpt

If you have been following the latest blog posts, you may have noticed that we have been working on implementing the System for Cross-domain Identity Management (SCIM) protocol in Keycloak. We are excited to announce that the SCIM Realm API is now available as an experimental feature in Keycloak 26.6. The SCIM Realm API allows you to manage users and groups in Keycloak using the SCIM protocol. This means that you can use any SCIM client to manage the user and group resource types in your realm. This is a great step towards improving the integrability of Keycloak with other (cross-domain) IAM solutions and downstream applications, thereby enabling common cloud use cases for identity (de)provisioning. In terms of integration, we focused on making the API as compatible as possible with Microsoft Entra ID, which is the integration most demanded by the community. To do that, we have used the EntraID SCIM Validator to validate our implementation and ensure that it meets the requirements of Microsoft Entra ID. In essence, the SCIM Realm API is the Admin API but compliant with SCIM. How to try it out? Since this is an experimental feature (not enabled by default), you need to enable it when starting the server: docker run --name kc-scim-api -d \ -e KEYCLOAK_ADMIN=admin \ -e KEYCLOAK_ADMIN_PASSWORD=admin \ -p 8080:8080 \ quay.io/keycloak/keycloak:nightly \ start-dev --features=scim-api Let us create a realm myrealm and enable the SCIM API for it. To do that, you can use the kcadm.sh script to create the realm and enable the API. First, you need to configure the credentials for the kcadm.sh script to be able to connect to the server: ./kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin Create the realm myrealm: ./kcadm.sh create realms -s realm=myrealm -s enabled=true -s scimApiEnabled=true Using the administration console, go to the Realm Settings page of your realm, and check that the SCIM API setting is enabled. Once the