User Lifecycle Management13% of the exam
SAML SSO, JIT and SCIM provisioning by plan
Which plan supports SAML SSO and SCIM and who configures them, how Slack matches a SAML sign-in to an existing account, when just-in-time provisioning is enough and when SCIM pre-provisioning is needed, and how SCIM handles email sync and billing.
Assess a scenario to determine the appropriate authentication and user provisioning options based on the Slack plan.
~8 min read · 5 practice questions ·
What the exam expects
- Decide whether a plan supports SAML SSO and SCIM, and whether a Workspace Owner or an Org Owner configures SSO.
- Explain how Slack matches a SAML sign-in to an existing account, and what must stay the same when the identity provider changes.
- Choose between just-in-time (JIT) provisioning and SCIM provisioning from when accounts must exist and which profile data must flow from the IdP.
- Keep email addresses synced from the IdP, and explain when SCIM-created accounts become billable.
Key terms:
- SAML SSO: sign-in through an identity provider (IdP) that passes authentication to Slack using SAML 2.0.
- NameID: the IdP-specific, unchanging identifier sent in the SAML response alongside the email address.
- JIT provisioning: Slack creates an account automatically the first time a user signs in through SSO.
- SCIM provisioning: the IdP creates, updates and deactivates Slack accounts ahead of sign-in through a connector app and the SCIM API.
Key facts
SAML SSO and SCIM plans
- Detail
- Business+ and Enterprise; Free and Pro only with a connected Salesforce org
Who enables SSO
- Detail
- Workspace Owner (Free, Pro, Business+); Org Owner (Enterprise)
Configure SSO in an Enterprise org
- Detail
- Org Owner permission
Additional SSO configurations
- Detail
- Up to 11
Account matching
- Detail
- NameID or email; no match creates a new account
Service Provider Issuer URL
- Detail
- Defaults to https://slack.com; must match the IdP
JIT
- Detail
- Default once SSO is configured; account at first sign-in
SCIM guests
- Detail
- Multi-Channel Guests on Enterprise plans only; otherwise create a member, then change the role
SCIM email sync
- Detail
- Only when members are restricted from changing email
SCIM billing
- Detail
- Billable at first sign-in, prorated
- Why must email addresses stay the same when an Enterprise org changes identity providers?
- When does JIT provisioning create a Slack account?
- Which role configures SAML SSO for an Enterprise org?
- Why would finance not pay for SCIM accounts that are never used?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 32 lessons of the Slack Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (5 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams