Configure user and group provisioning with SCIM and Azure AD


Zefort supports SCIM user and group provisioning with Azure AD (and various other SCIM providers).

With these instructions, you can set up SCIM, where users and groups from Azure AD are automatically provisioned to Zefort.

How is SCIM different from SAML?

SAML is mainly used for Single-Sign-On (SSO), while SCIM is only used for user and group provisioning. SAML does provision users in Zefort as they are logged in; this is sometimes called Just-in-Time (JIT) provisioning. With SCIM, users are created almost immediately as they are created by Azure AD, keeping your systems in sync without users needing to log in. SCIM also supports creating groups, which Zeforts SAML integration does not.

Prerequisites

You need:

  • To create this app, you need admin rights; you need one of the following roles Application Administrator, Cloud Application Administrator, or Global Administrator.
  • Administrative access to your Azure AD

Sidenote: as a best practice, organisations using Zefort often reserve some administrator user accounts for IT personnel, who only have access to configure account settings (and possibly manage user accounts), but no access to actual contracts or other content.

Overview

The steps to configure SCIM integration with Azure AD are:

  1. Create a SCIM integration in Zefort
  2. Create an Enterprise application in Azure
  3. Set up provisioning with tenant URL https://my.zefort.com/scim/v2 and token from the Zefort integration page
  4. Set up User and Group mapping to match what Zefort supports
  5. Enable provisioning

1. Create a SCIM integration in Zefort

In this step, you create a new SCIM integration object in Zefort.

Sign in to Zefort with your administrator account, and browse to Account settingsIntegrations.

Select “Connect” or “Connect another”  for SCIM.

Select which user type all new users should have under the “Provisioning” section.

Click “Show token”and take note of it, we are going to use it when settings up things in the Azure side.

2. Create an Enterprise application in Azure

In this step, you create an application in your Azure AD tenant configuration to be used for provisioning users and groups.

Microsoft’s instructions guide you through the creation, but in short, do the following:

  1. Log in to the Azure Active Directory portal.
  2. Go to Manage > Enterprise Applications in the left pane, and click + New application to create a new enterprise application.
  3. Click + Create your own application.
  4. Enter a name and select Integrate any other application you don’t find in the gallery (Non-gallery)

You can use this image as a logo:

Zefort-logo-215.png

4. Set up provisioning

  1. Go to the app’s Provisioning section.
  2. Click Get Started.
  3. In the provisioning properties, set the following:
    1. Provisioning Mode: Set to Automatic.
    2. Tenant URL: Set https://my.zefort.com/scim/v2
    3. Secret Token: Enter the token that we got from the SCIM integration in Zefort
  4. Click Test Connection to test whether the new app can connect to your SCIM API. If there are errors, ensure your tenant URL and secret token are correct and try again.
  5. Click Save

5. Set up User and Group mapping

Zefort only needs part of the fields that Azure AD can provision; for that reason, we need to configure the user and group mapping to match what Zefort supports.

Attribute mapping can be set by going to the Provisioning page and then clicking Edit attribute mapping. Then open the Mapping section.

We will configure Users and Groups separately. Remember to press Save after making the changes.

User Mapping

Azure Attribute SCIM Attribute
userPrincipalName userName
Switch([IsSoftDeleted], , “False”, “True”, “True”, “False”) active
displayName displayName
mailNickname externalId

Group Mapping

Azure Attribute SCIM Attribute
displayName displayName
objectId externalId
members members

Enable provisioning

Automatic provisioning

If you want to provision all users and groups automatically as they come in, do the following. On the Provisioning page, click the Start provisioning to start syncing users and groups.

On-demand provisioning

If you only want to provision certain users and groups, want to handle the provisioning manually, or want to test out the integration with just a single user or group, then go to the Provisioning page, and click Provision on demand.