What is bloodhound-scim-extension?

BloodHound SCIM Schema Extension helps security teams map how cloud-based identity systems like Okta and Microsoft Entra ID provision user accounts and groups into various applications. The main benefit is that it lets organizations see these cloud identity relationships inside BloodHound's visual graph, giving them a clearer picture of who has access to what across their connected tools. Many modern companies use cloud identity providers to automatically create and manage user accounts across dozens of applications. The protocol these providers use to push those accounts around is called SCIM, which stands for System for Cross-domain Identity Management. This extension teaches BloodHound to understand SCIM-provisioned users and groups so they appear as nodes in the graph alongside existing Active Directory data. Without this extension, mapping these connections would require building a separate custom integration for every possible pairing of identity provider and application. You would need one integration for Okta pushing to GitHub, another for Entra pushing to GitHub, another for Entra pushing to Salesforce, and so on. By representing the SCIM layer itself, the extension captures the relationships generically and avoids that multiplying complexity. Security analysts and identity administrators would use this to understand the blast radius of a compromised cloud identity. For example, if an attacker gains control of a SCIM-provisioned user account, the graph can show which application groups that user was added to and what resources those groups can reach. The project applies to both BloodHound Community Edition and BloodHound Enterprise. The README does not go into detail on the implementation or setup process, pointing instead to the main BloodHound documentation for full instructions.