Using SCIM 2.0 via Entra ID

SCIM is a widely accepted open standard that allows for the automation of user provisioning. It is designed to make managing user identities in cloud-based applications and services easier. SCIM has a set of default contracts for users and groups which can be extended to work hand-in-hand with Azure.

Note: This article describes how to use SCIM 2.0 with an Enterprise application. If you do not need automatic provisioning, you can use the Showpad app available on the Microsoft Azure Marketplace.

1. Open the Azure Dashboard and select Microsoft Entra ID from the resource blade.
2. Select Enterprise applications from the left-hand menu.
3. Click New application from the top menu, then Create your own application.
4. Enter the name of your application and select non-gallery app.
5. Click Create.

Creating and configuring your SCIM application

Admin credentials

1. Open the enterprise application you just created.
2. Click either Provisioning from the left-hand menu or select Provisioning Users Accounts from the Getting Started screen and then click Get started.
3. Select automatic for Provisioning Mode.
4. Obtain your Secret Token from Admin Settings by selecting API Tokens in the Showpad Admin portal.
5. Enter the Tenant URL, Secret Token and click Test Connection.
   The tenant URL is your Showpad Web Address followed by /api/users/scim/v2/?aadOptscim062020
   
   

   Note: The ?aadOptscim062020 parameter is needed for full SCIM compliance of the Entra ID implementation. See this Microsoft page for more information.

6. You will see a green checkmark and a success message when the connection is complete.
   After successfully testing the connection, click Save.

   The next section will cover configuration steps for Mappings and Settings, now that they are enabled.

Mappings

Azure automatically adds two default mappings to your enterprise application: Groups and Users.

User mappings

1. Within the management pane of your custom enterprise app, click Provisioning on the left column. Select Edit attribute mappings under Manage provisioning. Expand Mappings and click on Provision Azure Active Directory Users to configure the user mappings.
2. Ensure that User Mapping is Enabled and the Source Object is set to User.
3. If required, you can define scope filters in the Source Object Scope.
4. For a full provisioning service, ensure that Create and Update are checked in the Target Object Actions settings.
   • Check Delete if you want users deleted in Entra ID permanently deleted in Showpad. 
   • Uncheck Delete if you want users deleted in Entra ID to be deactivated in Showpad.
   
5. Scroll to the end of the page and activate the Show Advanced Options button.
6. Click Review your Schema here.
7. Copy and Paste the target application field schema from the Schema file provided by Showpad, here at the bottom of this article.
8. Save the new schema and return to the Attribute Mapping screen.
9. Delete non-required fields not available in Showpad from the Mappings, e.g., city, state, mailNickname. Check out this article in our Developer Portal, which contains an up-to-date list of available fields.
10. Map remaining or additional fields to the appropriate Showpad field. Make sure to define the field that should be used for matching unique values between both systems.
    Here are some examples:
    
    

    Entra ID Attribute	customappsso Attribute
    userPrincipalName	userName
    mail	emails[type eq "work"].value
    givenName	name.givenName
    surname	name.familyName
    objectId	externalId
    Switch([IsSoftDeleted], , "False", "True", "True", "False")	active

11. Click Save when you've finished building your schema.

Group Mappings

1. Click on Provision Azure Active Directory Groups to configure the group mappings.
2. Ensure that Group Mapping is Enabled and the Source Object is set to Group.
3. You can define scope filters in the Source Object Scope if needed.
4. For a full provisioning service, ensure that Create, Update, and Delete are activated from the Target Object Actions settings.
5. Scroll to the end of the page and activate the Show Advanced Options button.
6. Click Review your Schema here.
7. Copy and paste the target application field schema from the schema file attached to this article.
8. Save the new schema and return to the Attribute Mapping screen.
9. Delete non-required fields not available in Showpad from the Mappings, e.g., city, state, mailNickname. Check out this article in our Developer Portal for an up-to-date list of available fields.
10. Map remaining or additional fields to the appropriate Showpad field. Make sure to define the field that should be used for matching unique values between both systems.
    
11. Save your changes.

Note: To use Entra user attributes as Showpad user groups, consider creating Dynamic Membership Groups using membership rules in Azure. Learn more about managing rules for dynamic membership groups here.

Test your configuration

Before enabling the automatic provisioning, we highly recommend testing the configuration using the provision on-demand functionality.

1. Assign a user to your custom enterprise application.
2. Next, return to the Provisioning page of the app.
3. Select Provision on-demand from the top navigation bar.
   
4. Search for the user account that you assigned to the app and select it.
5. Click Provision at the bottom of the page.
6. The provisioning will start and list the result of each step as it's completed.
   
7. When all steps were successful, you can switch over to Showpad and confirm the user was successfully created with all the mapped properties assigned.

Start provisioning

1. From the provisioning home screen click the Start provisioning button to start the automatic process.
   
2. From this screen, you may also Stop, Restart, and Edit your provisioning, as well as configure Provisioning on demand. Click Refresh as needed.

Assigning users and groups

1. To provision or de-provision users and groups, they must be assigned to the enterprise app. To do so, go to the Overview section of your SCIM enterprise application.
2. Select Users and Groups from the left-hand navigation.
3. Click Add users/groups from the top navigation bar.
4. Search for users and/or groups you would like to add to this application and select them
5. Click Assign. 

Attachments