This feature automatically creates, updates, and deactivates Dive accounts in step with joiners, transfers, and leavers, based on your HR system or an identity provider (IdP) such as Microsoft Entra ID or Okta. Department, position, and employee number are also sent to the Dive roster. It supports SCIM 2.0, the industry-standard protocol.

This feature is available on the Enterprise plan. Owners set it up from a PC browser. It is commonly used together with Single Sign-On (SSO), but teams that do not use SSO can also use it.

What HR roster sync can do

• People added in the HR system or IdP are created as Dive users. People with an email address are created with the status "Inviting," and people without an email address are created as email-free accounts
• Changes to name, department, additional departments, position, phonetic reading (kana), employee number, hire date, employment type, and leave date are reflected in the Dive roster
• People who are disabled or deleted in the HR system or IdP are deactivated in Dive. Their viewing and training records are kept
• Group affiliation can be set based on the HR department, and permissions based on the position (see "Set groups and permissions from department and position (mapping)" below)

People created by sync count toward your number of accounts. They are created as View-only users (you can change this with mapping). The Owner role is not granted by sync.

For the departments and positions themselves, see Register departments and positions (roster departments, positions, phonetic readings, HR fields).

Setup

Issue a key in Dive

1. In the side menu, open [Owner Functions]
2. Select the [Security] tab at the top, then open [HR roster sync (SCIM)]
3. Turn on [Use HR roster sync]
4. In the [Key (secret token)] field, enter a note on purpose (e.g. Entra ID), then click [Issue key]
5. Copy the key that is displayed. The key is shown only on this screen. Paste it into the HR system or IdP settings, then close the screen

In the HR system or IdP, set the URL shown in the [Endpoint URL (tenant URL)] field on the card (https://app.divedx.com/api/scim/v2) and the key you issued.

You can have up to 5 active keys. To stop a key you no longer use, click [Revoke] in the list. A revoked key is shown as "Revoked" in the list, and sync from an HR system or IdP that uses it stops. In the list, [Last used] shows when each key was last used.

For Microsoft Entra ID

1. In the Microsoft Entra admin center, open [Enterprise applications], click [New application], and select [Create your own application]
2. Enter an app name (e.g. Dive) and select [Integrate any other application you don't find in the gallery (Non-gallery)] to create the app. Even if gallery apps with similar names appear as suggestions, do not select them
3. Open [Provisioning] for the app you created, and create a new configuration
4. Set [Authentication Mode] to [Bearer Authentication], enter the Dive endpoint URL in [Tenant URL] and the key issued in Dive in [Secret Token], click [Test Connection] to confirm the connection works, and save. After you create the configuration, you can check and change these settings under [Connectivity] in the left menu
5. Under [Users and groups], assign the people you want to sync to Dive
6. Under [Provisioning], open [Mappings] (in the new screen, [Attribute mapping] in the left menu), set [Provision Microsoft Entra ID Groups] to disabled ([No]), and save. Dive does not support group sync, so if this stays enabled, Entra ID will show an error when you assign groups. Even when groups are assigned, people in those groups are still synced
7. Click [Start provisioning] (provisioning also starts if you set [Provisioning Status] under [Provisioning] to [On] and save)

The user attribute mapping ([Provision Microsoft Entra ID Users]) can stay at the Entra ID default settings, and name, department, position, and employee number will reach Dive. To sync by assigning groups, a Microsoft Entra ID P1 or higher license is required on the Entra ID side. On a free tenant, assign users one at a time.

Sync runs about every 40 minutes after you click [Start provisioning]. To check right away, you can send people one at a time with [Provision on demand] in Entra ID. For how to use the Entra ID screens, see Microsoft's help.

For Okta or other HR systems

Other IdPs and HR systems that support SCIM 2.0, such as Okta, are set up with the same endpoint URL and key. For the authentication method, select the one that uses a key (Bearer token). For setup steps, see each service's help. If you send data from your own system, you can also sync by following the SCIM 2.0 standard.

Fields received

If a department or position that is not on the list is sent, it is created in the Dive department and position lists. Groups (SCIM Groups) are not accepted. To set group affiliation and permissions from department and position, use mapping.

On the card, open [Fields received and how sync works] to see the fields received and how sync works in one list. You can click the Dive extension URN to copy it.

How HR values are handled

• For department, additional departments, position, and HR fields, only the items that are sent become HR values. Fields that hold HR values are marked with [HR sync] in [User details] and can no longer be changed from the roster screen or Excel
• Fields that are not sent keep the values entered in Dive and can be changed on the roster screen or in Excel
• If a field that was sent before is no longer sent, its value is removed
• Name and phonetic reading can also be changed on screen. If a different value arrives from HR, it is overwritten
• The login email address is not changed by sync (only the invitation email address of people with the status "Inviting" is changed)

Logging in for people created by sync

People with an email address are created with the status "Inviting". Invitation emails are not sent automatically.

• Teams that use SAML SSO: the account is linked automatically when the person first logs in with SSO
• Teams that use Microsoft Entra ID (OIDC) SSO, or teams that do not use SSO: open [User management], open that person's [User details], then click [Resend invitation email] from the [...] menu at the top right. The person registers from the invitation email
• People with an email-free account: initial passwords are not handed out by sync. From the [...] menu at the top right of [User details], issue a password with [Reissue password] and give it to the person

While sync is in use, people who are not yet registered are not automatically created when they first log in with SSO (step 4 of Set up Single Sign-On (SSO)). This prevents people who are not in the HR system from logging in with SSO and using an account. People who are already registered can log in with SSO.

Leavers and deactivation

• People who are disabled or deleted in the HR system or IdP are deactivated in Dive. Roster records and viewing, training, and competency records are not deleted
• If they are re-enabled in the HR system or IdP, they are re-enabled in Dive at the next sync
• Owners can be deactivated by sync, but to re-enable them, use the [User management] screen (Restore a deactivated user)
• The last owner of a team is not deactivated by sync

Set groups and permissions from department and position (mapping)

Based on the department and position sent from HR, group affiliation and permissions can be set automatically. Owners and Team Administrators set this up.

1. Open [User management] in the sidebar, then click [Department / Position] at the top of the screen
2. Open the [Mapping] tab and turn on [Use mapping]
3. Under [Department → Group], select a Dive group for each department. If you check [Departments without a mapping inherit their parent department's mapping], a department without a selected group will use its parent department's group
4. Under [Position → Permission], select a permission for each position. People in a position set to [No mapping (no change)] keep their permissions
5. Click [Check what will change], then review [What will change when applied] (people affected, people whose permission changes, added to groups, removed from groups)
6. Click [Save and apply], then click [Save and apply] on the confirmation screen

• Once saved, the permissions and group affiliation of people added by HR sync are rewritten immediately. From then on, the mapping is applied each time a change arrives from HR
• Mapping applies only to the department and position sent from HR. It does not set anything based on a department or position entered on screen or in Excel
• Permissions can be chosen from View-only user, Created user, Group Administrator, and Team Administrator. You can only assign permissions up to the level you yourself are allowed to assign
• Mapping is not applied to Owners or Guests
• Group affiliation for groups that do not appear in the mapping table (for example, cross-department groups created only in Dive) is not changed
• Permissions and group affiliation set by mapping can no longer be changed from the roster screen or Excel

When the account limit is reached

• People are not created or enabled beyond the account limit. The error remains on the HR system or IdP side, and the attempt is retried at the next sync
• On the [HR roster sync (SCIM)] card, people who could not be created or enabled are shown by day (last 30 days)
• Around 8:00 the morning after a day when someone could not be created, owners are notified by email (only the number of people and the date are included)
• When you increase the number of accounts, people are created at the next sync from the HR system or IdP
• Changes to name, department, and other fields, as well as deactivation, are applied regardless of the limit

Stopping sync

When [Use HR roster sync] is turned off, sync stops. Fields that were locked from editing because they hold HR values can be changed again on the roster screen or in Excel. Changes received from the HR system or IdP while sync is stopped are not applied.

If your plan is no longer Enterprise, sync also stops. On the card, you can only stop sync and revoke keys.

Turning sync on or off, issuing or revoking keys, and roster changes made by sync are recorded in the audit log (Export the audit log as CSV).

Frequently asked questions

Q. Can groups be synced too?
A. Group sync (SCIM Groups) is not supported. To set group affiliation and permissions from HR department and position, use mapping.

Q. Can teams that do not use SSO also use this?
A. Yes. For people with an email address, resend the invitation email from the roster screen so they can register. People without an email address are created as email-free accounts.

Q. What permission do people created by sync get?
A. They get View-only user permission. If you use mapping, permissions can be set from position. You can also change permissions one person at a time on the roster screen (except for people whose permissions are set by mapping).

Q. Will people who are already in Dive be created twice?
A. People already in the roster are matched by email address and linked. The same person is not created twice.

Related information

Set up Single Sign-On (SSO) (Microsoft Entra ID / SAML 2.0)

Register departments and positions (roster departments, positions, phonetic readings, HR fields)

Overview of Security Settings (Owner Functions)

Add user (email invitation / Issue email-free account)