The System for Cross-domain Identity Management (SCIM) protocol automates the user identity lifecycle between an identity provider (IdP) and a service provider like GitHub. When a user is added to the IdP, SCIM provisions them in the GitHub organization (D). If a user's attributes (e.g., name, email) are updated in the IdP, SCIM synchronizes these changes to their GitHub profile (A). When a user is removed from the IdP, SCIM de-provisions them by deactivating their GitHub account and removing them from the organization, ensuring access is revoked promptly (B). This automates user onboarding, updates, and offboarding.

C. SCIM manages user identities and their access, not organizational assets like repositories. Deleting repositories is a separate administrative action unrelated to user provisioning.

E. SCIM is a protocol for identity management (provisioning/de-provisioning), not for generating authentication tokens for API access. Authentication is handled by other protocols like SAML or OAuth.

F. While SCIM can manage team membership, which indirectly affects permissions, it does not directly configure granular repository-level permissions (e.g., read, write, admin).

1. GitHub Docs

"About SCIM": "With SCIM

you can automate the exchange of user identity information between systems... For example

you can automatically provision a new employee's account and grant them access to various tools like GitHub." This supports option D. The document also states

"When an employee leaves the company and you deprovision their account

this change can automatically propagate to the connected systems

deactivating the user's account." This supports option B.

2. GitHub Docs

"Provisioning users and groups with SCIM": "When you update a user's information on your IdP

the IdP will automatically update the user's account on GitHub.com." This directly supports option A.

3. GitHub Docs

"Provisioning users and groups with SCIM": The document outlines the supported SCIM features

which include provisioning users

updating user attributes (name

email)

and de-provisioning users. It makes no mention of managing repositories (C)

generating API tokens (E)

or setting repository-level permissions (F).