From 1da23a75a2f24061c9a55ea077a67f519c2a5b06 Mon Sep 17 00:00:00 2001 From: AdamBouhmad Date: Thu, 25 Sep 2025 17:14:16 -0700 Subject: [PATCH 1/3] update reference to include migration guide for scim virtual groups --- .../reference/migration-guides/index.mdx | 12 ++++++ .../scim-virtual-groups-migration.mdx | 38 +++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 src/content/docs/fundamentals/reference/migration-guides/index.mdx create mode 100644 src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx diff --git a/src/content/docs/fundamentals/reference/migration-guides/index.mdx b/src/content/docs/fundamentals/reference/migration-guides/index.mdx new file mode 100644 index 000000000000000..7588db2fc6ae485 --- /dev/null +++ b/src/content/docs/fundamentals/reference/migration-guides/index.mdx @@ -0,0 +1,12 @@ +--- +pcx_content_type: navigation +title: Migration guides +sidebar: + order: 1 + group: + hideIndex: true +--- + +import { DirectoryListing } from "~/components"; + + diff --git a/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx b/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx new file mode 100644 index 000000000000000..82186a6abe2c366 --- /dev/null +++ b/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx @@ -0,0 +1,38 @@ +--- +pcx_content_type: reference +title: SCIM v1 to v2 Migration +sidebar: + order: 1 + label: SCIM migration +head: [] +description: Migrate from SCIM v1 Virtual Groups to Cloudflare’s GA SCIM User Groups +--- + +Cloudflare's first iteration of [SCIM integration](/scim/) introduced a concept called *Virtual Groups*, typically identified by the pattern `CF--` in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships. + +While customers could add or remove members from these groups within their IdP, Virtual Groups had important limitations: +- They could not be renamed or deleted in the IdP +- They could not be managed within Cloudflare +- Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually + +With the GA of [User Groups](https://developers.cloudflare.com/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to User Groups, which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**. + +If you have never synced a group linked to a `CF--` Virtual Group from your IdP to Cloudflare, no action is needed. + +## Migration steps + +1. **Create a new SCIM integration** in your IdP using an [Account Owned Token](/scim/authentication/) provisioned in Cloudflare +2. **Assign users & groups to your new Application** in your IdP, following a naming convention that aligns with your internal processes +3. **Sync groups to Cloudflare** and verify they appear in the **User Groups** pane of the Cloudflare Dashboard +4. **Attach permission policies** to the new User Groups so members inherit the correct access upon assignment to the group +5. **Migrate users** into the new groups incrementally, testing synchronization of users & groups into the Cloudflare Dashboard +6. **Clean up legacy resources** by removing SCIM v1 Virtual Groups and IdP mappings that follow the `CF--` pattern + +## More resources + +* [User Groups changelog](https://developers.cloudflare.com/changelog/2025-06-02-user-groups-beta/) +* [User Groups documentation](https://developers.cloudflare.com/fundamentals/manage-members/user-groups/) +* [Create an Account Owned Token](https://developers.cloudflare.com/fundamentals/api/get-started/account-owned-tokens/#create-an-account-owned-token) +* [SCIM provisioning setup guide](https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/) + + From 71364b397ec24da673fce1b9915a758a94cf9c6b Mon Sep 17 00:00:00 2001 From: Adam Bouhmad Date: Tue, 30 Sep 2025 14:04:02 -0700 Subject: [PATCH 2/3] add appropriate hyperlinks + styling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Denise Peña <75506267+dcpena@users.noreply.github.com> --- .../scim-virtual-groups-migration.mdx | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx b/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx index 82186a6abe2c366..d62800411aed120 100644 --- a/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx +++ b/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx @@ -11,28 +11,28 @@ description: Migrate from SCIM v1 Virtual Groups to Cloudflare’s GA SCIM User Cloudflare's first iteration of [SCIM integration](/scim/) introduced a concept called *Virtual Groups*, typically identified by the pattern `CF--` in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships. While customers could add or remove members from these groups within their IdP, Virtual Groups had important limitations: -- They could not be renamed or deleted in the IdP -- They could not be managed within Cloudflare -- Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually +- They could not be renamed or deleted in the IdP. +- They could not be managed within Cloudflare. +- Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually. -With the GA of [User Groups](https://developers.cloudflare.com/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to User Groups, which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**. +With the GA of [User Groups](https://developers.cloudflare.com/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to [User Groups](/fundamentals/manage-members/user-groups/), which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**. If you have never synced a group linked to a `CF--` Virtual Group from your IdP to Cloudflare, no action is needed. ## Migration steps -1. **Create a new SCIM integration** in your IdP using an [Account Owned Token](/scim/authentication/) provisioned in Cloudflare -2. **Assign users & groups to your new Application** in your IdP, following a naming convention that aligns with your internal processes -3. **Sync groups to Cloudflare** and verify they appear in the **User Groups** pane of the Cloudflare Dashboard -4. **Attach permission policies** to the new User Groups so members inherit the correct access upon assignment to the group -5. **Migrate users** into the new groups incrementally, testing synchronization of users & groups into the Cloudflare Dashboard -6. **Clean up legacy resources** by removing SCIM v1 Virtual Groups and IdP mappings that follow the `CF--` pattern +1. **Create a new SCIM integration** in your IdP using an [Account Owned Token](/scim/authentication/) provisioned in Cloudflare. +2. **Assign users & groups to your new Application** in your IdP, following a naming convention that aligns with your internal processes. +3. **Sync groups to Cloudflare** and verify they appear in the **User Groups** pane of the Cloudflare Dashboard. +4. **Attach permission policies** to the new User Groups so members inherit the correct access upon assignment to the group. +5. **Migrate users** into the new groups incrementally, testing synchronization of users & groups into the Cloudflare Dashboard. +6. **Clean up legacy resources** by removing SCIM v1 Virtual Groups and IdP mappings that follow the `CF--` pattern. ## More resources -* [User Groups changelog](https://developers.cloudflare.com/changelog/2025-06-02-user-groups-beta/) -* [User Groups documentation](https://developers.cloudflare.com/fundamentals/manage-members/user-groups/) -* [Create an Account Owned Token](https://developers.cloudflare.com/fundamentals/api/get-started/account-owned-tokens/#create-an-account-owned-token) -* [SCIM provisioning setup guide](https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/) +* [User Groups changelog](/changelog/2025-06-02-user-groups-beta/) +* [User Groups documentation](/fundamentals/manage-members/user-groups/) +* [Create an Account Owned Token](/fundamentals/api/get-started/account-owned-tokens/#create-an-account-owned-token) +* [SCIM provisioning setup guide](/fundamentals/account/account-security/scim-setup/) From 9742c5f35b6267375f9c43c7b0ceaa029929302f Mon Sep 17 00:00:00 2001 From: Adam Bouhmad Date: Thu, 2 Oct 2025 15:12:08 -0700 Subject: [PATCH 3/3] doc path updates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Denise Peña <75506267+dcpena@users.noreply.github.com> --- .../migration-guides/scim-virtual-groups-migration.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx b/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx index d62800411aed120..cf1040531032751 100644 --- a/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx +++ b/src/content/docs/fundamentals/reference/migration-guides/scim-virtual-groups-migration.mdx @@ -8,20 +8,20 @@ head: [] description: Migrate from SCIM v1 Virtual Groups to Cloudflare’s GA SCIM User Groups --- -Cloudflare's first iteration of [SCIM integration](/scim/) introduced a concept called *Virtual Groups*, typically identified by the pattern `CF--` in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships. +Cloudflare's first iteration of SCIM integration introduced a concept called *Virtual Groups*, typically identified by the pattern `CF--` in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships. While customers could add or remove members from these groups within their IdP, Virtual Groups had important limitations: - They could not be renamed or deleted in the IdP. - They could not be managed within Cloudflare. - Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually. -With the GA of [User Groups](https://developers.cloudflare.com/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to [User Groups](/fundamentals/manage-members/user-groups/), which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**. +With the GA of [User Groups](/changelog/2025-06-23-user-groups-ga/), Virtual Groups are now deprecated. Customers should migrate to [User Groups](/fundamentals/manage-members/user-groups/), which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to **SCIM User Groups**. If you have never synced a group linked to a `CF--` Virtual Group from your IdP to Cloudflare, no action is needed. ## Migration steps -1. **Create a new SCIM integration** in your IdP using an [Account Owned Token](/scim/authentication/) provisioned in Cloudflare. +1. **Create a new SCIM integration** in your IdP using an [Account Owned Token](/fundamentals/account/account-security/scim-setup/) provisioned in Cloudflare. 2. **Assign users & groups to your new Application** in your IdP, following a naming convention that aligns with your internal processes. 3. **Sync groups to Cloudflare** and verify they appear in the **User Groups** pane of the Cloudflare Dashboard. 4. **Attach permission policies** to the new User Groups so members inherit the correct access upon assignment to the group.