Group push to apps

Outbound SCIM provisioning already sends a user's groups as a field on that user's own record — see SCIM outbound provisioning. Group push is a different, additional capability: it creates and maintains an actual Group resource on the target application's SCIM endpoint, with its own membership, rather than only listing group names on each user.

Console: Identity → Group push, at /iam/group-push.

How it works

You create a mapping between a Qorionix group and a target application's SCIM connection. From then on, Qorionix's membership for that group is treated as the source of truth: the mapping creates the group on the target on first push, and every reconcile pass diffs Qorionix's current membership against what the target actually has and patches exactly the difference — nothing more.

Reconciliation isn't only run on demand. A worker sweep runs automatically every 15 minutes by default (configurable) across every active group-push mapping in every organisation, correcting drift without anyone having to notice it first. Each mapping is reconciled independently, so one unreachable target application never blocks the reconcile for any other mapping.

The console also offers a manual reconcile now action with a result notice, for when you don't want to wait for the next sweep.

The one real limitation, stated plainly

What to check before you rely on it

• Confirm the target application's users were themselves provisioned through Qorionix outbound SCIM (or otherwise share ids with Qorionix) before trusting a group-push mapping against it — otherwise the membership patch will be addressing the wrong external users.
• Watch the first reconcile's result notice closely rather than assuming a clean run.
• This is additive to, not a replacement for, the per-user groups field outbound provisioning already sends — see SCIM outbound provisioning for that mechanism.