1. Scope
This configuration guide is applicable for SCIM user provisioning from Microsoft Azure.
2. Who is this document for?
- Microsoft Azure Administrator who will configure the SCIM application for users and groups provisioning.
- Information Security Official who will review the administrative actions performed on the customer’s side.
3. Azure configuration
Log in to the Azure Portal via https://portal.azure.com/ and click on Enterprise applications:
3.1. Create new application
Click on + New application:
Click on + Create your own application:
Enter a name for the application an click Create:
The new SCIM application is created and shown:
3.2 Configure Provisioning Settings
Click on Manage → Provisioning:
Click on + New configuration:
Enter the information provided by Spacewell:
- Tenant URL: the SCIM endpoint
(e.g. https://integration.spacewell.com/api/v2/scim/Microsoft/<tenant>/<ID>/scim) - Secret token: the Access Token
Click Test connection to confirm the Tenant URL and Secret token are entered correctly.
Click Create to save the new configuration.
Go to Manage → Provisioning and enable the email notification and specify a email address to receive the notifications.
Confirm by clicking on Save:
3.3 Configure Provisioning Mappings
Open the Mappings option and make sure provisioning of Groups and Users is enabled:
Click on Provision Microsoft Entra ID Users:
Confirm that the Target Object Acces Create, Update and Delete are checked. If these are not checked, please ensure to check all of them to enable user auto-provisioning:
Verify that all Azure fields are properly mapped with the customappsso attribute. It should look like the screenshot below:
Close the Provision Microsoft Entra ID Users configuration and enable Provisioning Status and click Save:
3.4 Assign Users and/or Groups for provisioning
Go to Manage → Users and Groups. Assign the appliocable users and groups which are intended to provision through this application. Assigned users or groups should be auto-provisioned to Spacewell.
3.5 Test User Provisioning on demand
Before automatically enabling the provisioning, we can test the provisioning of users. If everything looks good during testing, then we can proceed to enable automatic provisioning. Below are the steps to perform provision on demand.
Go to Users and Groups:
Select the desired groups and click on Select:
Go to Overview (Preview) and click on Provision on demand.
Click Assign in the next screen to confirm.
Select a user (from a group) and click Provision:
Check with Spacewell to confirm that the user is created correctly in Asset:
Before enabling automatic provisioning for all applicable users, provision each of the applicable groups first via Provision on demand, to make sure all groups are synced and can be mapped to the corresponding profile in Asset.