SSO only handles login. Without provisioning, an account often appears only at first login and stays after the employee leaves. SCIM closes that gap: the IdP pushes changes to the application, including deactivation.
Technically the IdP calls endpoints such as /Users and /Groups on the application, usually authenticating with a bearer token. Microsoft Entra ID, Okta and others ship SCIM clients.
Typical problems: mismatched attribute mappings (e.g. userName vs. email), accounts created manually before SCIM that now get duplicated, and expired tokens that make provisioning stop without anyone noticing.