Skip to content

Commit 71364b3

Browse files
AdamBouhmaddcpena
andauthored
add appropriate hyperlinks + styling
Co-authored-by: Denise Peña <[email protected]>
1 parent 1da23a7 commit 71364b3

File tree

1 file changed

+14
-14
lines changed

1 file changed

+14
-14
lines changed

src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,28 +11,28 @@ description: Migrate from SCIM v1 Virtual Groups to Cloudflare’s GA SCIM User
1111
Cloudflare's first iteration of [SCIM integration](/scim/) introduced a concept called *Virtual Groups*, typically identified by the pattern `CF-<accountID>-<Role Name>` in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships.
1212

1313
While customers could add or remove members from these groups within their IdP, Virtual Groups had important limitations:
14-
- They could not be renamed or deleted in the IdP
15-
- They could not be managed within Cloudflare
16-
- Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually
14+
- They could not be renamed or deleted in the IdP.
15+
- They could not be managed within Cloudflare.
16+
- Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually.
1717

18-
With the GA of [User Groups](https://developers.cloudflare.com/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to User Groups, which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**.
18+
With the GA of [User Groups](https://developers.cloudflare.com/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to [User Groups](/fundamentals/manage-members/user-groups/), which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**.
1919

2020
If you have never synced a group linked to a `CF-<accountID>-<Role Name>` Virtual Group from your IdP to Cloudflare, no action is needed.
2121

2222
## Migration steps
2323

24-
1. **Create a new SCIM integration** in your IdP using an [Account Owned Token](/scim/authentication/) provisioned in Cloudflare
25-
2. **Assign users & groups to your new Application** in your IdP, following a naming convention that aligns with your internal processes
26-
3. **Sync groups to Cloudflare** and verify they appear in the **User Groups** pane of the Cloudflare Dashboard
27-
4. **Attach permission policies** to the new User Groups so members inherit the correct access upon assignment to the group
28-
5. **Migrate users** into the new groups incrementally, testing synchronization of users & groups into the Cloudflare Dashboard
29-
6. **Clean up legacy resources** by removing SCIM v1 Virtual Groups and IdP mappings that follow the `CF-<accountID>-<Role Name>` pattern
24+
1. **Create a new SCIM integration** in your IdP using an [Account Owned Token](/scim/authentication/) provisioned in Cloudflare.
25+
2. **Assign users & groups to your new Application** in your IdP, following a naming convention that aligns with your internal processes.
26+
3. **Sync groups to Cloudflare** and verify they appear in the **User Groups** pane of the Cloudflare Dashboard.
27+
4. **Attach permission policies** to the new User Groups so members inherit the correct access upon assignment to the group.
28+
5. **Migrate users** into the new groups incrementally, testing synchronization of users & groups into the Cloudflare Dashboard.
29+
6. **Clean up legacy resources** by removing SCIM v1 Virtual Groups and IdP mappings that follow the `CF-<accountID>-<Role Name>` pattern.
3030

3131
## More resources
3232

33-
* [User Groups changelog](https://developers.cloudflare.com/changelog/2025-06-02-user-groups-beta/)
34-
* [User Groups documentation](https://developers.cloudflare.com/fundamentals/manage-members/user-groups/)
35-
* [Create an Account Owned Token](https://developers.cloudflare.com/fundamentals/api/get-started/account-owned-tokens/#create-an-account-owned-token)
36-
* [SCIM provisioning setup guide](https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/)
33+
* [User Groups changelog](/changelog/2025-06-02-user-groups-beta/)
34+
* [User Groups documentation](/fundamentals/manage-members/user-groups/)
35+
* [Create an Account Owned Token](/fundamentals/api/get-started/account-owned-tokens/#create-an-account-owned-token)
36+
* [SCIM provisioning setup guide](/fundamentals/account/account-security/scim-setup/)
3737

3838

0 commit comments

Comments
 (0)