---
title: "ezgh sso applications provisioning set"
description: "Configure pushing an application's assigned users and groups to it over SCIM."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh sso applications provisioning set

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh sso applications provisioning set <application> [--base-url u] [--bearer-token-stdin | --bearer-token-file f] [settings] [flags]
```

Configure an oidc or saml application's outbound SCIM provisioning: EZGH SSO creates, updates and deactivates the users assigned to it (and with `--push-groups`, its assigned groups) at the application's SCIM 2.0 API.

What's given changes and the rest stays: ezgh reads the current settings and sends them whole with your changes, with the ETag it read, so if someone changed them in between nothing is changed and ezgh says so. The bearer token is read from stdin (`--bearer-token-stdin`: typed without echo on a terminal, or the first line piped in) or a file (`--bearer-token-file`), never from an argument. It's required the first time and whenever the base URL changes, and is never shown again. A new base URL starts over: everyone is pushed to it, and nothing is deprovisioned at the old one.

`--attribute-mapping` target=source replaces the mappings (they must map userName); a source is text with $&#123;user.email&#125;, $&#123;user.name&#125;, $&#123;user.givenName&#125;, $&#123;user.familyName&#125;, $&#123;user.department&#125;, $&#123;user.id&#125;, $&#123;user.slug&#125; or $&#123;user.tags.&lt;key&gt;&#125;. `--default-mappings` goes back to the defaults. `--catalog` &lt;id&gt; takes the catalog application's base URL (with `--param` for its parameters) and mappings. `--enabled=false` stops pushing and drops pending pushes. Unassigning or suspending someone always deactivates them there; `--hard-delete` also deletes users deleted here.

Part of [`ezgh sso applications provisioning`](/cli/reference/sso-applications-provisioning).

## Examples

```sh
ezgh sso applications provisioning set Slack --catalog slack --bearer-token-stdin < slack-token.txt
ezgh sso applications provisioning set Wiki --base-url https://wiki.acme.com/scim/v2 --bearer-token-file token.txt \
    --attribute-mapping 'userName=${user.email}' --attribute-mapping 'displayName=${user.name}' --push-groups
ezgh sso applications provisioning set Wiki --enabled=false
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--attribute-mapping` | string, repeatable |  | a SCIM attribute target=source, such as userName=$&#123;user.email&#125; (repeat; replaces the mappings) |
| `--base-url` | string |  | the application's SCIM 2.0 base URL (https, a public host) |
| `--bearer-token-file` | string |  | read the application's SCIM bearer token from this file |
| `--bearer-token-stdin` | boolean |  | read the application's SCIM bearer token from stdin (never an argument) |
| `--catalog` | string |  | take the base URL and mappings from this catalog application's SCIM settings |
| `--default-mappings` | boolean |  | use the default attribute mappings |
| `--enabled` | boolean | `true` | push changes (false stops pushing and drops pending pushes) |
| `--hard-delete` | boolean |  | delete users at the application when they're deleted here (otherwise they're deactivated) |
| `--param` | string, repeatable |  | for `--catalog`: a parameter of the catalog application, name=value (repeat) |
| `--push-groups` | boolean |  | push the groups assigned to the application, with their provisioned members |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/sso-applications-provisioning-set/index.mdx