This article provides an overview of the user provisioning and authentication methods available in Comeen Play, to help you understand how users access the platform and how their accounts are created and managed.
1. User Provisioning Overview
Comeen Play offers flexible user provisioning options. Pre-creating user accounts is not always required, as accounts can be created dynamically when users log in.
The following provisioning methods are available:
Manual Creation
Administrators can create users directly from the Users page. See Create Users.
CSV Import
Users can be imported in bulk with a CSV file, to onboard many users at once. On the Users page, click "Import CSV file".
Just-In-Time Provisioning (JIT)
User accounts are automatically created at the time of their first login via SAML authentication (see section 3 below).
SCIM Provisioning
Your identity provider can automatically create, update and deactivate Comeen Play users using the SCIM 2.0 protocol (see section 4 below).
API Provisioning
An API lets you integrate your own systems and manage user provisioning programmatically. For more information, contact your Customer Success Manager or Support.
2. Authentication Methods
Comeen Play supports several authentication methods. Each method can be enabled or disabled in Settings â Authentication:
Google Authentication
Users can sign in with their Google account. See Activate SSO (Single sign-on).
Microsoft Authentication
Users can sign in with their Microsoft account. See Activate SSO (Single sign-on).
Email and Password
A local authentication method using email and password is also available. See How to reset my password?
SAML (Single Sign-On)
Comeen Play supports SAML-based authentication, enabling integration with identity providers (IdP) such as Okta, Microsoft Entra ID, Cisco Duo or Ping Identity.
3. Just-In-Time (JIT) Provisioning
Just-In-Time provisioning is a key feature of Comeen Play when using SAML authentication. It can be enabled or disabled, so you can use SAML for authentication only if you prefer.
How it works
When JIT provisioning is enabled, if a user signs in through a SAML identity provider and does not yet have an account in Comeen Play, their account is automatically created at login.
Benefits
No need for prior user synchronization
Simplified integration with existing identity systems
Reduced administrative overhead
Roles and user groups assigned dynamically from SAML attributes
Role Management
User roles can be assigned dynamically during the JIT process by mapping specific SAML attributes sent by the identity provider. See Manage User Role Permissions.
4. SCIM Provisioning
SCIM (System for Cross-domain Identity Management) 2.0 is available in Comeen Play. It lets your identity provider manage the full lifecycle of Comeen Play accounts: users are created when they are assigned to the app in the IdP, their profiles stay in sync, and they are deactivated as soon as they are unassigned or deactivated in the IdP.
How it works
SCIM is enabled per space in Settings â SCIM Provisioning, which provides a SCIM base URL specific to that space.
The identity provider authenticates with a bearer token created in Comeen Play, or with OAuth2 (client credentials) for providers that support it.
A default role can be assigned automatically to every user created through SCIM.
Groups pushed from the identity provider are created as user groups in Comeen Play, and their membership is kept in sync.
Every create, update and deactivation event is logged in the Provisioning activity section.
On the Users page, SCIM-managed users show a SCIM badge, and deactivated users are listed in the Disabled Users tab. See Manage your users.
SCIM or JIT?
JIT provisioning creates an account only when a user signs in for the first time. SCIM provisions accounts in advance, keeps profiles and groups up to date, and deactivates users automatically when they leave. Choose SCIM when you need centralized user lifecycle management from your identity provider.
SCIM manages accounts, while sign-in is still handled by SSO. We recommend configuring both, using the user's email as the identifier on each side so that SSO and SCIM resolve to the same Comeen Play account.
Setup guides
Summary
Comeen Play provides a flexible and modern approach to user management:
Multiple authentication methods (Google SSO, Microsoft SSO, email and password, SAML)
Automatic user creation via Just-In-Time provisioning
Automated user lifecycle management via SCIM 2.0
Optional manual and CSV-based provisioning
This approach allows organizations to integrate quickly with their identity systems while minimizing setup complexity.