Note: The functionality described below is available only to Grammarly Business enterprise accounts. If you’re interested in enabling this feature, please contact your account manager or the Grammarly Support team.
You can configure System for Cross-domain Identity Management (SCIM) for your Grammarly Business account, which automatically provisions members when they are assigned Grammarly application access at your identity provider if you are using a supported identity provider. The identity providers currently supported for SCIM-based provisioning are Okta, Azure AD, and OneLogin.
In order to use SCIM-based provisioning within your Grammarly Business account, you must be already using SAML Single Sign-On (SSO) for user authentication. For more information, please see this article.
When using SAML SSO, by default your identity provider does not communicate with Grammarly Business to create members when you assign or unassign users to the application. Grammarly Business performs just-in-time (JIT) provisioning of the member’s account the first time a member signs in via your identity provider. With the enablement of SCIM-based provisioning, your identity provider will notify Grammarly when users are assigned or unassigned application access.
When you assign application access, your identity provider will communicate with Grammarly to create a member account and send an onboarding email to the user. When you unassign application access, your identity provider will communicate with Grammarly to invalidate any authenticated sessions and deactivate the member’s account. The Grammarly account will be suspended within an hour of receiving the deletion request and permanently deleted within 30 days.
To configure provisioning for your Grammarly Business account, you must enable provisioning on the Grammarly Account Hub, obtain a provisioning token, and then configure provisioning for your Grammarly application in your identity provider. The provisioning configuration in your identity provider communicates with your Grammarly Business account via our SCIM API.
Supported identity providers
The following identity providers can provision or de-provision members on your Grammarly Business account using SCIM.
Turning on provisioning with existing members
If you already have team members in your Grammarly Business account and you turn on provisioning, a reconciliation process needs to happen. As part of this process, your identity provider will notify Grammarly of all assigned users. Grammarly will reconcile users already invited via a provisioning request from the identity provider and their status will be reflected on the Members page. To determine users who haven’t been reconciled with the identity provider, access the Provisioning page. If there are users who haven’t yet been provisioned by the identity provider, the Provisioning page will show a warning banner. Click the Download report link to download a CSV file containing the list of members that haven’t yet been provisioned. This report can be used to bulk delete outstanding users, if appropriate, or for manual processing.
Note: For some identity providers, the step to provision already assigned users may have to be triggered manually. See the identity-provider-specific steps for more information.