Skip to content

Add SCIM provisioning troubleshooting page #26223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 4, 2025
+34 −0
Merged

Add SCIM provisioning troubleshooting page #26223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9dc7ba2
Add SCIM troubleshooting page with instructions for restoring Super A…
Oct 31, 2025
6aea0be
Update wording from suggestions and fix links
mcescalante Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/content/docs/fundamentals/account/account-security/scim-setup/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ Expectations for user lifecycle management with SCIM:
## Limitations

- If a user is the only Super Administrator on an Enterprise account, they will not be deprovisioned.
- It is possible to unintentionally remove all account Super Administrators by misconfiguring SCIM groups. Refer to [SCIM troubleshooting](/fundamentals/account/account-security/scim-setup/troubleshooting/) for more information.

## Prerequisites

Expand Down
33 changes: 33 additions & 0 deletions ...ntent/docs/fundamentals/account/account-security/scim-setup/troubleshooting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
---
pcx_content_type: how-to
title: SCIM troubleshooting
sidebar:
label: Troubleshooting
---

## Restore Super Administrator after group misconfiguration

If you have removed all Super Administrators mistakenly, you can restore the role to account member(s) using the Account API Token you created for SCIM provisioning.

First, fetch a list of account members and find the member ID for the user you want to restore Super Admin to via [list members].(/api/resources/accounts/subresources/members/methods/list/)

```curl
curl -X GET "https://api.cloudflare.com/client/v4/accounts/{account_id}/members" \
-H "Authorization: Bearer YOUR_SCIM_AOT" \
-H "Content-Type: application/json"
```

Then restore the Super Admin role to that member via [update member](/api/resources/accounts/subresources/members/methods/update/)

```curl
curl -X PUT "https://api.cloudflare.com/client/v4/accounts/{account_id}/members/{member_id}" \
-H "Authorization: Bearer YOUR_SCIM_AOT" \
-H "Content-Type: application/json" \
-d '{
"roles": ["33666b9c79b9a5273fc7344ff42f953d"]
}'
```

:::note
33666b9c79b9a5273fc7344ff42f953d is the Super Administrator role ID
:::
Loading