> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom Access Provisioning

> Build custom workflows for resources that don't support SCIM provisioning

Custom provisioning workflows automate access grants and revocations for resources without SCIM support. Define workflows using natural language instead of manual provisioning.

<Note>
  Use SCIM provisioning when available. Custom workflows are for resources without SCIM support where you want to avoid manual provisioning.
</Note>

***

## When to Use Custom Provisioning

* The resource doesn't support SCIM
* You have API or CLI access to the resource
* Manual provisioning would otherwise be required

## How It Works

Custom provisioning requires two workflows:

* **Provisioning workflow:** Grants access
* **Deprovisioning workflow:** Revokes access

Both workflows must be explicitly defined. Workflows cannot reverse themselves.

***

## Create a Provisioning Workflow

<Steps>
  <Step title="Open the role">
    In Access Manager, open the role you want to configure
  </Step>

  <Step title="Start a new workflow">
    Next to "Choose a provisioning workflow," click **+**
  </Step>

  <Step title="Enter provisioning steps">
    In the workflow builder, enter your steps below the template line:

    ```
        Create a custom provisioning workflow with the following steps.
    ```

    <Warning>
      Do not delete or modify the template line. It identifies the workflow type.
    </Warning>
  </Step>

  <Step title="Write instructions">
    Write the provisioning steps in natural language

    <Tip>
      **Example:** Create a custom provisioning workflow with the following steps.

      1. Check if the user has Slack user access
      2. If the user lacks Slack user access, provision it first
      3. Grant Slack admin access via API
    </Tip>
  </Step>

  <Step title="Test the workflow">
    Click **Test workflow** to verify the logic
  </Step>

  <Step title="Publish">
    Click **Publish** when ready
  </Step>
</Steps>

<Frame caption="Custom provisioning workflow builder">
  <img src="https://mintcdn.com/serval/1MkNvweOjUDMFgE8/images/Screenshot2025-10-30at8.21.11PM.png?fit=max&auto=format&n=1MkNvweOjUDMFgE8&q=85&s=55ea4030963ea1dbfe5ee298bf442c08" alt="Custom provisioning workflow builder interface showing natural language input" width="3452" height="1978" data-path="images/Screenshot2025-10-30at8.21.11PM.png" />
</Frame>

***

## Create a Deprovisioning Workflow

<Steps>
  <Step title="Return to the role">
    In Access Manager, open the same role
  </Step>

  <Step title="Start deprovisioning workflow">
    Next to "Choose a deprovisioning workflow," click **+**
  </Step>

  <Step title="Enter deprovisioning steps">
    Enter your steps below the template line:

    ```
        Create a custom deprovisioning workflow with the following steps.
    ```

    <Warning>
      Do not delete or modify the template line.
    </Warning>
  </Step>

  <Step title="Write instructions">
    Write the deprovisioning steps in natural language

    <Tip>
      **Example:** Create a custom deprovisioning workflow with the following steps.

      1. Remove Slack admin access via API
      2. Downgrade to Slack member access

      For applications where users likely have base access, only remove elevated access, not overall access.
    </Tip>
  </Step>

  <Step title="Test and publish">
    Test and publish the workflow
  </Step>
</Steps>

***

## Link Workflows to the Role

<Steps>
  <Step title="Select the role">
    In Access Manager, select the role
  </Step>

  <Step title="Link provisioning workflow">
    Under "Custom workflow," select your published provisioning workflow
  </Step>

  <Step title="Link deprovisioning workflow">
    Under "Deprovisioning workflow," select your published deprovisioning workflow
  </Step>
</Steps>

The workflows are now active and will run automatically based on your access policy.

<Note>
  Custom provisioning workflows execute only through access requests managed by the access policy. They cannot be triggered manually.
</Note>

<Tip>
  View all provisioning and deprovisioning workflows in the Workflow Builder. Provisioning workflows are marked with a green key icon, deprovisioning with red.
</Tip>

<Frame caption="Provisioning and deprovisioning workflows marked with key icons">
  <img src="https://mintcdn.com/serval/1MkNvweOjUDMFgE8/images/Screenshot2025-10-30at8.26.46PM.png?fit=max&auto=format&n=1MkNvweOjUDMFgE8&q=85&s=a37a4b4cc88f5af2bdb1c15a7e605565" alt="Workflow Builder showing provisioning and deprovisioning workflows with key icons" width="3456" height="1982" data-path="images/Screenshot2025-10-30at8.26.46PM.png" />
</Frame>

***

## Verify the Configuration

Test the complete flow:

1. Submit an access request for the role
2. Verify the provisioning workflow executes correctly
3. Wait for the access period to expire or manually revoke access
4. Verify the deprovisioning workflow executes correctly