SCIM: User provisioning with Microsoft Entra ID

SCIM, System for Cross-domain Identity Management, is an open standard for automating user provisioning. With SCIM, it's easy to add, update or remove users across different applications simultaneously. The solution is built using the SCIM 2.0 specification.

In order to set up user provisioning with Microsoft Entra ID, it has to be configured both in Scoro and Microsoft Entra ID.

1. Set up SCIM in Scoro

2. Set up Microsoft Entra ID Enterprise Application

1. If you are planning to use both User Provisioning and Single Sign-On, please check the manual for connecting Scoro and SSO and do it before continuing with the SCIM configuration.
2. If you don’t have SSO and you are not planning to add it, please make sure that you have an Enterprise Application before continuing.
   1. In the Microsoft Entra ID Portal, select Enterprise Applications and click New application.
      
   2. Click Create your own application.
   3. Give your application a Name, choose “Integrate any other application you don't find in the gallery (Non-gallery)” and click Create.
      

3. Configure Microsoft Entra ID Provisioning

Note! Microsoft Entra ID has known issues with SCIM 2.0 protocol compliance and it requires some extra configuration, which is explained in detail in the next paragraph. Read more about the situation here.

1. In the Manage tab of the new application, choose Provisioning.
2. Choose the Automatic provisioning mode.
3. Enter Admin Credentials, which you will find from the Scoro SCIM setup page.
   1. Tenant URL = Company base URL + “/?aadOptscim062020” (special flag for compliance fix)
   2. Secret token = Bearer token
4. Click Test Connection.
5. If credentials are correct, you will see a success message in the top right corner and you will be able to Save the settings.

4. Map user attributes

After you have successfully saved the credentials, you will need to configure the Mappings and Settings sections

1. Open Mappings to configure the mapping between Scoro and Microsoft Entra ID
   
2. Disable Groups provisioning since this is not supported by Scoro SCIM
   
3. Open Users provisioning to map out correct fields between Scoro and Microsoft Entra ID
   1. Keep only the fields that can be synced with Scoro SCIM:
      
      - userName
      - name.givenName
      - name.familyName
      - name.formatted
      - title
      - active
      - email
      - phoneNumbers
      - userType * (doesn’t exist by default)
   2. Other listed attributes can be deleted because these can’t be updated in Scoro.
4. Configure/check the following fields:
   1. Activate/deactivate users
      1. Keep the Microsoft Entra ID attribute Switch ([IsSoftDeleted], , "False", "True", "True", "False") active
         
      2. Keep the first letters of values “True” and “False” capitalized
      3. You can read more about application provisioning.
   2. Update userType
      1. Add a new mapping for userType
      2. You can use user types that are defined for your application or define new user types
      3. The values that Scoro can use are “user” and “admin”
      4. If user type names don’t match with the user types in Scoro, the expression builder can be used to switch the values:
         
         - Example with Role: (Switch([Role], , "Member", "user", "Admin", "admin"))
      5. Alternatively, you can remove the matching and manage user types in Scoro only
   3. Update emails and phoneNumbers
      1. Email and phoneNumbers support only filtering by type (emails/phoneNumbers[type eq "work"].value)
         
      2. All other filter mappings are not supported
5. The complete list of mapped values
   
6. Configure Settings
   1. We recommend to choose Scope - “Sync only assigned users and groups”
   2. You can also choose whether you want to receive email notifications or not
      
7. Save the changes after you have added all the mappings
8. You can enable/disable provisioning by choosing Start/Stop provisioning or edit details by choosing Edit provisioning
   
9. User provisioning between Scoro and Microsoft Entra ID is now configured.

Note!

• Active values have to be “True” and “False” with the first letter capitalized, otherwise the on-demand provisioning can’t be enabled.
• Scoro SCIM supports only the “work” type filter for phoneNumbers and emails (emails[type eq "work"].value)