Set up SCIM with Microsoft Entra

Automate the provisioning and deprovisioning of Entra users

Read time 2 minutes

Last updated a day ago

Prerequisites

Before you set up System for Cross-domain Identity Management (SCIM) for Entra, ensure these requirements are met:

You have set up single sign-on (SSO) for an organization in Unity Cloud. You have added, to your SSO setup, the domains whose users you want to automate provisioning for. Unity has validated these domains. Read more about creating an organization and setting up SSO.
An Entra instance exists and manages these users.
An existing Entra application is set up with Unity SSO.

Before you configure SCIM, provision a Unity service account:

Go to the Unity Dashboard.
To switch to the organization for which you want to set up SCIM, select your organization name, select Switch organization, and then select an organization.
Go to Administration > Service accounts.
To create a service account, select New.
Enter a name and a description for the service account, and then select Create. Unity creates a service account and displays its details.
Assign the SCIM Authenticator role to the account:
1. In the Organization Roles section, select Manage Organization Roles.
2. Set Admin to
```
SCIM Authenticator
```
  , and then select Save.
Create a long-lived bearer token for the authentication and use of the service account:
1. In the Bearer tokens section, select Add bearer token.
2. Copy the bearer token and keep it. Your Identity Provider (IdP) service requires this information.

Read more about creating a Unity service account in the Unity Services documentation.

On a new tab, go to the Unity Dashboard.
Switch to the organization for which you want to set up SCIM.
Go to Administration > Single sign on.
In the SCIM section, locate the field for the SCIM base connector URL and copy the value. Your IdP service requires this information.

On a new tab, sign in to your Microsoft Entra admin instance with an admin account.
Go to Entra ID > Enterprise Apps, and then select your Unity SSO application.
On the Overview tab, select Provision User Accounts.
Select Create configuration > Connect your application.
Set this configuration:
- Select authentication method: bearer authentication
- Tenant URL: the value of the SCIM base connector URL that you have copied from Unity Cloud
- Secret token: the long-lived bearer token that you have generated for your service account
Select Test Connection. Entra verifies the setup and informs you of any errors.
Select Start provisioning. Entra starts the batch provisioning of users, which runs every 40 minutes. Entra begins by provisioning the users that you have already added to this application.

To trigger the immediate provisioning of specific Entra users, complete these steps:

Ensure that the users have been added to the application:
1. Go to Users and groups.
2. If the users aren't listed as members of the application, select Add user/group to add them.
Go to Provision on demand.
Select the users you want to immediately provision, and then select Provision. Entra immediately provisions these users.