You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,20 +8,20 @@ head: []
8
8
description: Migrate from SCIM v1 Virtual Groups to Cloudflare’s GA SCIM User Groups
9
9
---
10
10
11
-
Cloudflare's first iteration of [SCIM integration](/scim/) introduced a concept called *Virtual Groups*, typically identified by the pattern `CF-<accountID>-<Role Name>` in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships.
11
+
Cloudflare's first iteration of SCIM integration introduced a concept called *Virtual Groups*, typically identified by the pattern `CF-<accountID>-<Role Name>` in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships.
12
12
13
13
While customers could add or remove members from these groups within their IdP, Virtual Groups had important limitations:
14
14
- They could not be renamed or deleted in the IdP.
15
15
- They could not be managed within Cloudflare.
16
16
- Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually.
17
17
18
-
With the GA of [User Groups](https://developers.cloudflare.com/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to [User Groups](/fundamentals/manage-members/user-groups/), which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**.
18
+
With the GA of [User Groups](/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to [User Groups](/fundamentals/manage-members/user-groups/), which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**.
19
19
20
20
If you have never synced a group linked to a `CF-<accountID>-<Role Name>` Virtual Group from your IdP to Cloudflare, no action is needed.
21
21
22
22
## Migration steps
23
23
24
-
1.**Create a new SCIM integration** in your IdP using an [Account Owned Token](/scim/authentication/) provisioned in Cloudflare.
24
+
1.**Create a new SCIM integration** in your IdP using an [Account Owned Token](/fundamentals/account/account-security/scim-setup/) provisioned in Cloudflare.
25
25
2.**Assign users & groups to your new Application** in your IdP, following a naming convention that aligns with your internal processes.
26
26
3.**Sync groups to Cloudflare** and verify they appear in the **User Groups** pane of the Cloudflare Dashboard.
27
27
4.**Attach permission policies** to the new User Groups so members inherit the correct access upon assignment to the group.
0 commit comments