GoKawiilFirezone built a custom directory sync engine instead of using SCIM
Firezone, an access-control platform that relies on identity-provider data for permissions, explains how it synchronizes users and groups from systems like Entra, Google, and Okta. Rather than adopting the SCIM standard, the company built its own directory sync engine to pull in users, groups, and membership changes.
GoKawiil's interpretation of the reporting above, not reported fact.
Directory sync underpins how access decisions get made, so reliability and speed in reflecting personnel changes directly affects security. Firezone's choice to skip the common SCIM standard suggests the company found it insufficient for its performance or reliability needs, though the specifics of those tradeoffs are only hinted at in the post. Other teams building access-control tools may weigh similar build-vs-adopt decisions when integrating with identity providers.
- Firezone's access model is built on groups synced from identity providers like Entra, Google, and Okta.
- The company opted to build a custom directory sync engine rather than implement the SCIM standard.
- Directory sync must track new users/groups, updates, and removals to keep an app's copy of the org directory current.
Source: firezone.dev, 2026-10-02
Published there as: “Building reliable (and fast) directory sync”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.