> ## Documentation Index
> Fetch the complete documentation index at: https://help.skillsdb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Career Automations

> Automatically assign careers to SCIM-provisioned users based on their group membership, with configurable scope for first-time vs. every-sync assignment.

<Info>
  **Quick Summary:** Attach career automations to a custom SCIM group to automatically assign careers when users are provisioned into that group. Each automation has a scope — either `First provisioning only` (assign on first join only) or `Always assign` (assign on every sync).
</Info>

## Overview

Career automations tie SCIM group membership to SkillsDB career assignments. When a user is provisioned into a custom SCIM group that has career automations attached, SkillsDB assigns the configured careers to that user automatically — no manual assignment required.

Career automations are useful when:

* New hires in a specific role should always start with a standardized career (for example, every new `FinanceAnalysts` SCIM group member gets the "Finance Analyst" career)
* You want careers to re-sync every time a user's group membership changes, ensuring their assigned careers always match their current role
* You manage team membership in your identity provider and want SkillsDB career assignments to follow automatically

Career automations are configured per custom SCIM group. The two default groups (`SkillsdbGlobalAdmins` and `SkillsdbFullAccess`) do not support career automations.

## Prerequisites

Before setting up career automations, make sure you have:

* **Permission level**: SkillsDB administrator
* **Setup requirement**: At least one custom SCIM group (see [SCIM Groups and Permissions](/identity-and-provisioning/scim-groups-and-permissions))
* **Setup requirement**: The careers you want to assign already exist in SkillsDB
* **Access requirement**: **Settings > SSO & SCIM > Configure SSO and SCIM settings**

## What a career automation contains

Each career automation on a custom SCIM group has three fields:

| Field  | Required | Purpose                                                                                                                                |
| ------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Career | Yes      | The SkillsDB career to assign to users in this group.                                                                                  |
| Level  | No       | The career level to assign. Populated dynamically from the selected career. If left blank, SkillsDB assigns the first available level. |
| Scope  | Yes      | Controls when the assignment runs. See [How scope controls assignment timing](#how-scope-controls-assignment-timing) below.            |

A single custom SCIM group can have any number of career automations. Each automation is evaluated independently when a SCIM event for a member of the group arrives.

## How scope controls assignment timing

The **Scope** field is the most important knob on a career automation. It determines whether the automation runs only once per user, or every time the user is synced.

| Scope                       | When the career is evaluated                                                                                                                                                                                         | Best for                                                                                                                  |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **First provisioning only** | Only the first time the user becomes a member of this group. Once the automation has run for a user, subsequent syncs skip it.                                                                                       | Onboarding defaults. Use when you want to seed a career and let managers reassign it later without SkillsDB restoring it. |
| **Always assign**           | Every time the user is synced to the group. If the career is no longer assigned, SkillsDB re-assigns it. If a target level is configured and the current level differs, SkillsDB updates the level. Otherwise no-op. | Enforcing a standardized career. Use when the SCIM group authoritatively defines what career the user should hold.        |

<Warning>
  **Warning:** **Always assign** automations restore the configured career and level on every sync. If a manager removes the career from a member, the next SCIM event for that user re-assigns it. If a manager changes the level and the automation has a target level set, the level is reverted on the next sync. Manager edits that match the automation's configuration are not affected.
</Warning>

If you want the group to *only* assign the career for new members and never touch existing members' careers afterward, use **First provisioning only**.

## How to add a career automation

Career automations are configured in the same modal used to create or edit a custom SCIM group. There is no separate screen.

<Steps>
  <Step title="Open the SSO & SCIM settings">
    Navigate to **Settings > SSO & SCIM** and select **Configure SSO and SCIM settings**.
  </Step>

  <Step title="Open the group">
    In the **Custom SCIM Groups** table, select the edit icon on the group you want to configure. Alternatively, select **Create SCIM Group** in the top right to create a new group.
  </Step>

  <Step title="Scroll to the Career Automations section">
    Below the **Permission Level** dropdown, the modal contains a **Career Automations** section.
  </Step>

  <Step title="Add an automation">
    Select **+ Add Career Automation**. A new row appears with empty fields.

    1. Select a **Career** from the searchable dropdown
    2. Select a **Level** if the career has multiple levels (optional)
    3. Select a **Scope**: **First provisioning only** or **Always assign**
  </Step>

  <Step title="Add more automations or remove one">
    Select **+ Add Career Automation** again to add another career. Select the trash icon next to any row to remove it.
  </Step>

  <Step title="Save">
    Select **Save Changes** (when editing) or **Create** (when creating a new group).
  </Step>
</Steps>

Once saved, the automation runs on the next SCIM event that affects a member of the group. For newly created groups, this means the next time Entra (or your IdP) provisions someone into the matching group.

## How to change or remove a career automation

To change an existing automation, edit the custom SCIM group and modify the automation row. Changes apply to future SCIM events — they do not retroactively re-run against current members unless those members are synced again.

To remove an automation, select the trash icon next to its row and save. Careers that were previously assigned by the removed automation remain on the users' profiles. Removing an automation does not un-assign careers from anyone — it only stops the automation from running in the future.

<Tip>
  **Tip:** If you need to un-assign careers after removing an automation, do it manually from the affected users' profiles or contact SkillsDB Support for bulk-update options.
</Tip>

## What happens when a user is deactivated

When a SCIM-provisioned user is deactivated (removed from all SCIM groups, disabled in the IdP, or unassigned from the SCIM application), SkillsDB cleans up career automation records associated with that user's SCIM group memberships. The user's actual career assignments are preserved on their (now inactive) profile for historical and reporting purposes.

If the same user is later reactivated through SCIM and re-provisioned into groups with career automations, the automations run as if they were a new user — **First provisioning only** automations will run again, treating the reactivation as a first provisioning.

## Common Questions

<AccordionGroup>
  <Accordion title="What happens if I set scope to Always assign and a manager removes or changes the career in SkillsDB?">
    On the next SCIM sync for that user, SkillsDB re-applies the automation. If the manager removed the automation's career, it is re-assigned. If the manager changed the level on that career and the automation specifies a target level, the level is restored. Other careers the manager assigned to the user are not affected. Use **First provisioning only** if you want manager changes to stick.
  </Accordion>

  <Accordion title="Can I add career automations to the default SkillsdbGlobalAdmins or SkillsdbFullAccess groups?">
    No. Career automations are only supported on custom SCIM groups. If you want Admins or Full Access users to receive a career automatically, create a custom group (for example, `FinanceAdmins`), set its permission level to Admin or Full Access, and attach a career automation.
  </Accordion>

  <Accordion title="Will changing an automation's career retroactively update existing group members?">
    Not until those members are synced again. Career automations run in response to SCIM events. To force a re-sync, restart provisioning in your identity provider — see [Azure Sync Considerations](/identity-and-provisioning/azure-sync-considerations) for how to restart provisioning in Entra.
  </Accordion>

  <Accordion title="How do I verify a career automation ran for a specific user?">
    Navigate to **Settings > SSO & SCIM > Event Log** and filter by **Event Type: Career Assigned** and the affected user. Each successful automation run is logged as a **Career Assigned** event.
  </Accordion>

  <Accordion title="What if the career I want to automate doesn't exist yet in SkillsDB?">
    Create the career first through the normal careers library flow. Once the career exists, it appears in the **Career** dropdown of the automation row.
  </Accordion>

  <Accordion title="Can I have multiple automations that assign the same career?">
    Yes, but it's rarely useful — the result is the same as a single automation. Multiple automations are typically used to assign different careers, or the same career at different levels to different groups.
  </Accordion>
</AccordionGroup>

## Related Articles

<CardGroup cols={2}>
  <Card title="SCIM Groups and Permissions" icon="users-gear" href="/identity-and-provisioning/scim-groups-and-permissions">
    Create and manage the custom SCIM groups that career automations attach to.
  </Card>

  <Card title="SCIM Event Log" icon="clipboard-list" href="/identity-and-provisioning/scim-event-log">
    Verify automation runs by filtering the event log for Career Assigned events.
  </Card>

  <Card title="Careers Library" icon="book" href="/libraries/careers">
    Create and manage the careers referenced by automations.
  </Card>

  <Card title="SCIM Setup" icon="gear" href="/identity-and-provisioning/scim-setup">
    Prerequisite — configure SCIM provisioning before setting up automations.
  </Card>
</CardGroup>

## Need More Help?

For help designing your career automation strategy or troubleshooting assignment issues, reach out to your organization's SkillsDB administrator or contact [SkillsDB Support](https://www.skillsdb.com/support).