Update SCIM and workflow groups

content/en/docs/marketplace/platform-supported-content/modules/scim/_index.md

@@ -34,6 +34,8 @@ Before you include the SCIM module in your app, you need to check if your IdP su
 
 * **B2E vs. B2C apps:** Many organizations use a common Identity Provider, such as Entra ID in Microsoft’s Office 365 suite, to centralize employee accounts. If you are building apps for employees (Business-to-Employee or B2E), connecting them with Entra ID is a common and easy choice. As an app developer, you can use OIDC SSO or SAML for Single Sign-On and the SCIM module for managing users. For apps designed for customers (Business-to-Customer or B2C), the use of the SCIM module may not be as obvious. If your organization uses a third-party solution, such as Entra ID to handle customer accounts, you can also use the SCIM module for that.
 
+* **Manage workflow group members:** Use identity information provisioned through SCIM, such as roles or other user attributes, to automatically assign users to [workflow groups](/refguide/workflow-groups/). With custom user provisioning logic, applications using runtime-managed workflow groups can also create workflow groups based on information maintained in the identity provider.
+
 ### Features {#features}
 
 Your IdP can perform create, read, update, and delete (CRUD) operations on the users in your app when it includes the SCIM module. It has the following features:
@@ -70,10 +72,10 @@ If you are using the SCIM module in combination with Entra ID and OIDC SSO, you
 
 The SCIM module has the following limitations:
 
-* The SCIM module does not sync groups (or group memberships) to your app. Starting from version 4.1.0, you can assign user roles using the SCIM `roles` attribute. See [Assigning Roles Through SCIM Provisioning] (#role-assignment) below. For earlier versions, you can assign user roles using the features offered by [SAML SSO](/appstore/modules/saml/) or [OIDC SSO](/appstore/modules/oidc/) modules.
 * If you want to do **Provision on demand** from Entra ID to test the SCIM integration of your app you cannot trigger a partial sync based on a group. This will trigger Entra ID to invoke a `/groups` endpoint, which is not yet supported.
 * The module does not support the development of a SCIM client application.
 * Multiple clients can be configured only at runtime via the admin screen.
+* The SCIM module does not support full management of workflow groups using SCIM. However, starting from version 4.1.0, you can use attributes (`roles` or any other attributes) on the SCIM user to associate users with [workflow groups](#workflow-group-assignment). In Mendix 11.16 and above, when **Group definition** is set to **Runtime**, you can create [workflow groups](/refguide/workflow-groups/) in your app using custom provisioning logic. This mechanism creates workflow groups automatically when a provisioned user needs one. The SCIM module currently does not support updating or deleting existing groups.
 
 ### SCIM Protocol Adherence
 
@@ -313,6 +315,14 @@ For different `Expression` and `Target Attribute` values, refer to [Provisioning
 The default `UC_CustomProvisioning` microflow handles role assignment automatically when configured. You can customize this microflow to implement your own role mapping logic based on your application's requirements.
 {{% /alert %}}
 
+#### Assigning Workflow Groups {#workflow-group-assignment}
+
+The `roles` or any other attribute of a SCIM user (or other user attribute) can also be used to manage [workflow group](/refguide/workflow-groups/) membership.
+
+Customize `UC_CustomProvisioning` to map the relevant provisioned attributes to workflow groups and add or remove the provisioned user as a member of those groups.
+
+When runtime-managed workflow groups are enabled, the custom provisioning logic can also create a corresponding workflow group if one does not yet exist (supported from Mendix 11.16 and above). For more information, see the [Managing Groups at Runtime](/refguide/workflow-groups/#runtime-groups) section of *Workflow Groups*.
+
 ### Runtime Configuration
 
 #### API Security {#api_security}

content/en/docs/refguide/modeling/application-logic/workflows/workflow-groups.md

@@ -84,12 +84,28 @@ Workflow groups that are removed from the app are also removed from the database
 The **Name** and **Description** attributes of a **System.WorkflowGroup** object should not be modified. These changes will be overwritten in the next (re)deployment. Renaming a group or changing its description should only be done through the app settings in Studio Pro.
 {{% / alert %}}
 
-### Adding Users
+### Adding Users to Groups
 
 Before workflow groups can be used effectively, they must first be populated with users.
 
 This is done by setting the **WorkflowGroup_User** association between the **System.WorkflowGroup** object and the **User** objects that should belong to the workflow group. The [Workflow Commons](/appstore/modules/workflow-commons/) module provides default pages to do so.
 
+#### Managing Users in a Workflow Group Using an Identity Provider
+
+You can manage workflow group membership based on user attributes provided by an external identity provider (IdP), such as Entra ID. This allows organizations to centrally manage roles and group memberships in their IdP, rather than maintaining them separately in each application.
+
+This can be done when a user logs in, using the user provisioning logic in the [SAML](/appstore/modules/saml/user-provisioning/) or [OIDC SSO](/appstore/modules/oidc/#user-provisioning-end-user-onboarding) module, or before the user's first login by provisioning the user through the SCIM module. SCIM also lets changes in the IdP take effect without requiring the user to log in first.
+
+You can customize the user provisioning microflow to use `roles` or other provisioned attributes to determine workflow group membership. The custom provisioning logic can:
+
+* Find the corresponding workflow group
+
+* Add or remove the user as a member of the workflow group, either at login or when the user is created, or updated through SCIM
+
+* When using runtime-managed workflow groups, create the workflow group if it does not yet exist.
+
+For more information about customizing SCIM provisioning, see the [SCIM](/appstore/modules/scim/) module documentation.
+
 ## Using Workflow Groups in XPath
 
 ### XPath Tokens