Configure user and group provisioning with SCIM and Azure AD
Zefort supports SCIM user and group provisioning with Azure AD (and various other SCIM providers).
With these instructions, you can set up SCIM, where users and groups from Azure AD are automatically provisioned to Zefort.
How is SCIM different from SAML?
SAML is mainly used for Single-Sign-On (SSO), while SCIM is only used for user and group provisioning. SAML does provision users in Zefort as they are logged in; this is sometimes called Just-in-Time (JIT) provisioning. With SCIM, users are created almost immediately as they are created by Azure AD, keeping your systems in sync without users needing to log in. SCIM also supports creating groups, which Zeforts SAML integration does not.
- To create this app, you need admin rights; you need one of the following roles Application Administrator, Cloud Application Administrator, or Global Administrator.
- Administrative access to your Azure AD
Sidenote: as a best practice, organisations using Zefort often reserve some administrator user accounts for IT personnel, who only have access to configure account settings (and possibly manage user accounts), but no access to actual contracts or other content.
The steps to configure SCIM integration with Azure AD are:
- Create a SCIM integration in Zefort
- Create an Enterprise application in Azure
- Set up provisioning with tenant URL https://my.zefort.com/scim/v2 and token from the Zefort integration page
- Set up User and Group mapping to match what Zefort supports
- Enable provisioning
1. Create a SCIM integration in Zefort
In this step, you create a new SCIM integration object in Zefort.
Sign in to Zefort with your administrator account, and browse to Account settings → Integrations.
Select “Connect” or “Connect another” for SCIM.
Select which user type all new users should have under the “Provisioning” section.
Click “Show token”and take note of it, we are going to use it when settings up things in the Azure side.
2. Create an Enterprise application in Azure
In this step, you create an application in your Azure AD tenant configuration to be used for provisioning users and groups.
Microsoft’s instructions guide you through the creation, but in short, do the following:
- Log in to the Azure Active Directory portal.
- Go to Manage > Enterprise Applications in the left pane, and click + New application to create a new enterprise application.
- Click + Create your own application.
- Enter a name and select Integrate any other application you don’t find in the gallery (Non-gallery)
You can use this image as a logo:
4. Set up provisioning
- Go to the app’s Provisioning section.
- Click Get Started.
- In the provisioning properties, set the following:
- Provisioning Mode: Set to Automatic.
- Tenant URL: Set
- Secret Token: Enter the token that we got from the SCIM integration in Zefort
- Click Test Connection to test whether the new app can connect to your SCIM API. If there are errors, ensure your tenant URL and secret token are correct and try again.
- Click Save
5. Set up User and Group mapping
Zefort only needs part of the fields that Azure AD can provision; for that reason, we need to configure the user and group mapping to match what Zefort supports.
Attribute mapping can be set by going to the Provisioning page and then clicking Edit attribute mapping. Then open the Mapping section.
We will configure Users and Groups separately. Remember to press Save after making the changes.
|Azure Attribute||SCIM Attribute|
|Switch([IsSoftDeleted], , “False”, “True”, “True”, “False”)||active|
|Azure Attribute||SCIM Attribute|
If you want to provision all users and groups automatically as they come in, do the following. On the Provisioning page, click the Start provisioning to start syncing users and groups.
If you only want to provision certain users and groups, want to handle the provisioning manually, or want to test out the integration with just a single user or group, then go to the Provisioning page, and click Provision on demand.