SCIM Configuration in Entra ID

SCIM protocol. For a reliable and efficient synchronization of users from Entra ID, s.GUARD supports the SCIM (System for Cross-domain Identity Management) protocol. Using SCIM, all modifications on…

Updated
SCIM protocol

For a reliable and efficient synchronization of users from Entra ID, s.GUARD supports the SCIM (System for Cross-domain Identity Management) protocol.

Using SCIM, all modifications on the Entra ID user base will be synchronized automatically to s.GUARD:

  • Creation of new users
  • Modification of existing users
  • Soft delete (deactivation of users on s.GUARD)
  • Deletion of users
SCIM configuration in Entra ID

The following steps give guidance on how to setup the SCIM synchronization in Entra ID:

  1. Log in to Microsoft Azure portal
  2. Go to "Microsoft Entra ID"
  3. Open "Enterprise Applications"
  4. Click "+ New application", then "+ Create your own application"
    1. Define a name for the application (e.g. "s.GUARD SCIM")
    2. Select "Integrate any other application you don't find in the gallery (Non-gallery)"
    3. Confirm with "Create"
  5. Go to "Manage -> Provisioning"
    1. Click "+ New configuration"
    2. Select authentication method "Bearer authentication"
    3. Enter the following Tenant URL: https://api.instasolution.ch/scim/v2
    4. Enter the Secret token which will be provided to you by the s.GUARD support team
    5. Click "Test connection"
    6. Confirm with "Save" if the connection has been tested successfully
  6. Go to "Manage -> Provisioning -> Attribute mapping"
    1. Select "Provision Azure Active Directory Users"
    2. Adapt the attribute mapping table as needed to include the attributes which shall be synchronized to s.GUARD
  7. Go to "Manage -> Users and groups" and assign all users and user groups that shall be synchronized with s.GUARD
  8. Go to "Manage -> Provisioning" and start the provisioning
Mandatory attributes

The following attributes are mandatory and must be synchronized with s.GUARD:

  • userName
  • name.familyName
  • name.givenName
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber
  • emails[type eq "work"].value
  • preferredLanguage
  • active
Synchronization of user groups

Assigning user groups for synchronization (Manage -> Users and groups):

It is possible to add user groups to the s.GUARD SCIM enterprise application.
In that case, all users which belong to that group will be synchronized with s.GUARD.

Synchronization of SCIM groups (Manage -> Provisioning -> Attribute mapping)

The option "Provision Microsoft Entra ID Groups" is currently not supported by s.GUARD.
This leads to the effect that a user's group membership from Entra ID will not be reflected in s.GUARD.

Silent login for the Windows desktop client

Contact