Using SCIM 2.0 via Azure AD

SCIM is a widely accepted open standard that allows for the automation of user provisioning. It is designed to make managing user identities in cloud-based applications and services easier. SCIM has a set of default contracts for users and groups which can be extended to work hand-in-hand with Azure.

1. Open the Azure Dashboard and select Azure Active Directory from the resource blade.
2. Select Enterprise applications from the left-hand menu.
3. Click New application from the top menu, then Create your own application.
4. Enter the name of your application and select non-gallery app.
5. Click Create.

Creating and configuring your SCIM application

Admin credentials

1. Open the enterprise application you just created.
2. Click either Provisioning from the left-hand menu or select Provisioning Users Accounts from the Getting Started screen and then click Get started.
3. Select automatic for Provisioning Mode.
4. Obtain your Secret Token from Admin Settings by selecting API Tokens in the Showpad Admin portal.
5. Enter the Tenant URL, Secret Token and click Test Connection.
   The tenant URL is your Showpad Web Address followed by /api/users/scim/v2/?aadOptscim062020
   

   Note: The ?aadOptscim062020 parameter is needed for full SCIM compliance of the AzureAD implementation. See this Microsoft page for more information.

6. You will see a green checkmark and a success message when the connection is complete.
   After successfully testing the connection, click Save.

   The next section will cover configuration steps for Mappings and Settings, now that they are enabled.

Mappings

Azure automatically adds two default mappings to your enterprise application: Groups and Users.

User mappings

1. Click on Provision Azure Active Directory Users to configure the user mappings.
2. Ensure that User Mapping is Enabled and the Source Object is set to User.
3. If required you can define scope filters in the Source Object Scope.
4. For a full provisioning service, make sure that Create, Update and Delete are activated from the Target Object Actions settings.
5. Scroll to the end of the page and activate the Show Advanced Options button.
6. Click Review your Schema here.
7. Copy and Paste the target application field schema from the Schema file provided by Showpad, here at the bottom of this article.
8. Save the new schema and go back to the Attribute Mapping screen.
9. Delete non-required or fields not available in Showpad from the Mappings, e.g. city, state, mailNickname. Check out this article in our Developer Portal which contains an up-to-date list of available fields.
10. Map remaining or additional fields to the appropriate Showpad field. Make sure to define the field that should be used for matching unique values between both systems.
    Here are some examples:
    
    

    Azure Active Directory Attribute	customappsso Attribute
    userPrincipalName	userName
    mail	emails[type eq "work"].value
    givenName	name.givenName
    surname	name.familyName
    objectId	externalId
    Switch([IsSoftDeleted], , "False", "True", "True", "False")	active

11. Click Save when you've finished building your schema.

Group Mappings

1. Click on Provision Azure Active Directory Groups to configure the group mappings.
2. Ensure that Group Mapping is Enabled and the Source Object is set to Group.
3. If needed, you can define scope filters in the Source Object Scope.
4. For a full provisioning service, make sure that Create, Update and Delete are activated from the Target Object Actions settings.
5. Scroll to the end of the page and activate the Show Advanced Options button.
6. Click Review your Schema here.
7. Copy and paste the target application field schema from the Schema file provided by Showpad
8. Save the new schema and go back to the Attribute Mapping screen.
9. Delete non-required or fields not available in Showpad from the Mappings, e.g. city, state, mailNickname. Check out this article in our Developer Portal for an up-to-date list of available fields.
10. Map remaining or additional fields to the appropriate Showpad field. Make sure to define the field that should be used for matching unique values between both systems.
    
11. Save your changes.

Test your configuration

Before enabling the automatic provisioning, we highly recommend testing the configuration by using the provision on-demand functionality.

1. Assign a user to your custom Azure app.
2. Next, return back to the Provisioning page of your SCIM App.
3. Select Provision on-demand from the top navigation bar.
   
4. Search for the user account that you assigned to the app and select it.
5. Select it and click provision at the bottom of the page.
6. The provisioning will start and list the result of each step as it's completed.
   
7. In case all steps were successful, you can switch over to Showpad and confirm the user was successfully created with all the mapped properties assigned.

Start provisioning

1. From the provisioning home screen click, the Start provisioning button to start the automatic process.
   
2. From this screen, you may also Stop, Restart, Edit your provisioning, as well as configure Provisioning on demand. Click Refresh as needed.

Assigning users and groups

1. To provision or de-provision users and groups, they need to be assigned to the enterprise app. To do so, go to the Overview section of your SCIM enterprise application.
2. Select Users and Groups from the left-hand navigation.
3. Click Add users/groups from the top navigation bar.
4. Search for users and/or groups you would like to add to this application and select them
5. Click Assign. 

Attachments