> ## Documentation Index > Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt > Use this file to discover all available pages before exploring further. # Keeper SCIM > Connect a Keeper Enterprise node to Triggr with a SCIM provisioning token, to onboard and offboard Keeper users and teams. Triggr works with the users and teams in one node of a Keeper Enterprise tenant, yours or a managed company's: provisioning, updating, locking and deactivating users, and managing teams. To manage Keeper MSP accounts as a distributor, use [Keeper MSP](https://kb.mspprocess.com/integrations/keeper/msp.md) instead. ## Set up Keeper SCIM You need admin rights to add provisioning methods in the tenant's Keeper Admin Console (for a managed company, the Manage Companies permission in your Keeper MSP console). Users' email domains must be [reserved](https://docs.keeper.io/enterprise-guide/domain-reservation) to the tenant. **1. Open the node** In the Admin Console, go to **Admin** and select the node Triggr should provision into. It must be below the root node, and sub-nodes aren't included. **2. Add a SCIM method** On the node's Provisioning tab, click **Add Method**, select SCIM (System for Cross-Domain Identity Management) and click Next. **3. Generate the token and save** Click **Create Provisioning Token** (or Generate), copy the URL and token, then click Save. The token only works once the method is saved, and the method then shows as Pending. The URL has the form `https:///api/rest/scim/v2/`. Keeper Commander's `scim create --node=""` prints the same URL and token; the node ID is the number at the end of the URL, not the separate SCIM ID Commander also prints. See Keeper's [API Provisioning with SCIM](https://docs.keeper.io/enterprise-guide/user-and-team-provisioning/automated-provisioning-with-scim). ## Connect it in Triggr **1. Open the integration** Go to **Integrations > Keeper SCIM** and click Configure on the Base Configuration card. ![The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=bb81acb082055015f91beda7b4876f35) **2. Enter the node and token** Select the Region host from your URL, enter the digits at the end of the URL as SCIM Node ID, paste the SCIM Bearer Token and click Save Configuration. ![The Keeper SCIM configuration window with a Region host dropdown, SCIM Node ID and SCIM Bearer Token fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/keeper-scim/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=68456a8d0c990fb3f0f0b9441fa4fcf5) One connection covers one node. To connect a different node, click Edit and enter its details. ## How Keeper handles changes * New users are invited by email. Set `userName` to the user's email address. * New teams and team memberships wait for approval by an administrator, a team member, Keeper Commander or [Keeper Automator](https://docs.keeper.io/sso-connect-cloud/device-approvals/automator). * Deactivate User locks the account rather than deleting it. * List actions return 1,000 results by default; page with `startIndex` and `count`. Bodies use SCIM JSON, as in Keeper's [Using SCIM API Provisioning](https://docs.keeper.io/enterprise-guide/user-and-team-provisioning/automated-provisioning-with-scim/using-scim-api-provisioning). ## Troubleshooting > [accordion] Every action fails with 401 > > Check the token was pasted in full, the method was saved in the Admin Console, and Region host and SCIM Node ID match the URL. To get a new token, run `scim edit ` in Keeper Commander. > [accordion] Create User fails with 409 > > The email is already used in another Keeper tenant or node. For a user in this tenant, move them into the SCIM node in the Admin Console first. > [accordion] Create User fails with 428 > > The tenant has no licensed seats left. Add licences or free up seats. > [accordion] A user or team doesn't appear in Keeper > > It's waiting for approval, or the user's email domain isn't reserved to the tenant. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.