Groups and custom attributes mapping are now generally available, completing the Directory Sync (SCIM) GA rollout that began with the core provisioning release. Both features are enabled for all users with no extra configuration required.

• Groups mapping assigns Clerk roles automatically based on IdP group membership. When a user is added to a group in your IdP, Clerk applies the mapped role. When they're removed, they fall back to the next mapped role. For users in multiple groups with different role mappings, a configurable precedence order controls which role wins.

• Custom attributes mapping syncs additional user data from your IdP (such as department, employee_id, or cost_center) directly into publicMetadata on the Clerk user object. Attribute definitions are configured once at the enterprise connection level and shared across both your SSO connection (SAML or OIDC) and your Directory Sync connection, so the same attributes are available regardless of how a user authenticates or is provisioned. When Directory Sync is enabled, it becomes the exclusive source for those attribute values and they're read-only in Clerk until Directory Sync is disabled.

Getting started

To enable Directory Sync, navigate to an enterprise connection in the Clerk Dashboard, open the Directory Sync tab, and toggle it on. Clerk generates a SCIM base URL and bearer token to configure in your IdP.

Refer to the Directory Sync documentation for setup guides, the Role mapping documentation for groups-to-role configuration, and the Custom attribute mapping documentation for details on the shared attribute pool.

Pricing

Directory Sync, including groups and custom attributes mapping, is included with your enterprise connection at no extra charge. Refer to the pricing page for connection pricing details.