Back to Checks
vercel

Vercel team has directory sync (SCIM) enabled for automated provisioning

team_directory_sync_enabled
Service: teamSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundariesvercel-enterprise-plan
Resource Type:NotDefined

Vercel team is assessed for directory sync (SCIM) enablement. Directory sync automates user provisioning and deprovisioning by synchronizing team membership with an external identity provider, ensuring timely access revocation when employees leave.

Prowler logoProwlerprowler-provider-vercel

Risk

Without directory sync, user provisioning and deprovisioning must be managed manually, increasing the risk of orphaned accounts remaining active after employees leave or change roles. Manual processes are error-prone and may lead to unauthorized access persisting longer than intended.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks team_directory_sync_enabled

Recommendation

Enable directory sync (SCIM) to automate user lifecycle management. This ensures that team membership stays synchronized with your identity provider, automatically provisioning new members and revoking access when employees leave or change roles.

Remediation

Other

1Navigate to your Vercel team settings
2Go to the Security section
3Configure directory sync (SCIM) with your identity provider
4Map identity provider groups to Vercel team roles
5Enable automated provisioning and deprovisioning

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.team.team_client import team_client


class team_directory_sync_enabled(Check):
    """Check if directory sync (SCIM) is enabled for the Vercel team.

    This class verifies whether the Vercel team has directory sync enabled,
    allowing automated user provisioning and deprovisioning through an
    identity provider.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Team Directory Sync Enabled check.

        Iterates over all teams and checks if directory sync is enabled.

        Returns:
            List[CheckReportVercel]: A list of reports for each team.
        """
        findings = []
        for team in team_client.teams.values():
            report = CheckReportVercel(
                metadata=self.metadata(),
                resource=team,
                resource_name=team.name,
                resource_id=team.id,
            )

            if team.directory_sync_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Team {team.name} has directory sync (SCIM) enabled "
                    f"for automated user provisioning."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Team {team.name} does not have directory sync (SCIM) enabled. "
                    f"User provisioning and deprovisioning must be managed manually."
                    f"{plan_reason_suffix(team.billing_plan, {'hobby', 'pro'}, 'directory sync (SCIM) is only available on Vercel Enterprise plans.')}"
                )

            findings.append(report)

        return findings

References