SCIM provisioning error: “Forbidden Access” due to existing individual account

Who can use this feature?

Available on Enterprise plan.

Accessible to Owners and Admins on Web App.

When provisioning users via SCIM (System for Cross-domain Identity Management) through an identity provider (IdP) such as Okta or Azure AD, you may encounter the following error:

An error occurred while assigning this app. Automatic provisioning of user [email] to app Alohi failed: Error while verifying if user [email] exists: Forbidden. Errors reported by remote server: Forbidden access.

This error typically indicates that the user you are trying to provision already has an existing Free individual account on the Alohi platform under the same email address.

Since SCIM-based provisioning is intended for managing users within a centralized organizational directory, it cannot take control over personal accounts that were previously created by the user independently.

Resolution steps

To successfully provision the user through your IdP:

  1. Ask the affected user to delete their existing individual account by visiting the following link:
    https://app.fax.plus/data-deletion
  2. Once the user completes the deletion process, retry the provisioning through your IdP.

Still not working?

If you’re unsure whether a user has an individual account, please contact our support team with a list of email addresses you’d like to provision. We’ll check if any of them are linked to existing Free accounts and advise on the next steps.

Best practices for SCIM provisioning

To prevent conflicts like this in the future:

  • Inform users not to sign up individually using their corporate email addresses before being provisioned via SCIM.
  • Provision users through your IdP first, ensuring their access is managed and aligned with your organization’s policies.
Was this article helpful?
0 out of 0 found this helpful
More Articles in this section