Before you start
You need administrator rights on the portal.
You (or your identity team) need admin access to your identity provider to configure the provisioning connection.
What SCIM provisioning does
Your identity provider pushes user changes to Hamilton Apps through the standard SCIM v2 protocol. Each pushed user becomes an employee (resident) record:
New user in the directory: the employee is created in Hamilton Apps.
Updated user (name, email, department, manager...): the employee record is updated.
Deactivated or deleted user: the employee is disabled — never deleted, so history is preserved.
Get the connection details
Sign in to Hamilton Apps and click your name in the top right corner, then Settings.
In the administration menu, click SCIM.
The page shows everything your identity provider needs:
URL: the SCIM endpoint of your tenant (ending in /scim/v2). Click the clipboard button to copy it — "URL copied" confirms.
Token: the bearer token that authenticates the connection. Click the clipboard button to copy it — "Token copied" confirms.
Expiration date: when the token expires. Plan to renew the configuration before that date.
Treat the token as a secret: only paste it into your identity provider's provisioning configuration.
Configure your identity provider
In your identity provider, create or open the provisioning configuration of the Hamilton Apps application.
Paste the URL as the tenant/endpoint URL and the Token as the secret token, then test the connection.
Assign the users (or groups) to provision and start the provisioning.
Understand the attribute mapping
The SCIM page documents exactly how incoming SCIM attributes fill the employee record. Highlights:
Identity: userName, givenName, familyName, active, preferredLanguage, work email, work and mobile phone numbers map directly.
externalId is stored as the synchronization ID that ties the two systems together.
Job title, department and company: matched by name — and created automatically in Hamilton Apps if they do not exist yet.
Rights group (groups) and site (work address region): matched by name — if not found, the default value is used, so a misspelled group or site never blocks provisioning.
Manager (enterprise extension): linked to the manager's employee record.
Employee ID and badge number (enterprise extension) fill the corporate ID and badge RFID fields.
Fields not mapped by your identity provider take the application's default values.
Supported operations
The endpoint supports the standard SCIM user operations: create (POST /Users), read (GET /Users/{id} and filtered queries), update (PATCH), replace (PUT) and disable (DELETE or PATCH with active=false).
Verify the provisioning
Provision a test user from your identity provider.
In Hamilton Visitor or Hamilton Meeting, open the residents management and check the test user's record: identity, site, department, rights group.
Change an attribute in the directory and confirm it propagates, then deactivate the test user and confirm the employee is disabled.
Good to know
Provisioned employees sign in with SSO when it is enabled; account fields managed by the synchronization should not be edited manually, as the next sync overwrites them.
Group, site, department and company names in the directory should match the names configured in Hamilton Apps to avoid default-value fallbacks.