Set up a SCIM Provisioning App in Azure Active Directory

Last modified on October 4, 2023

This guide will show you how to set up an Azure Active Directory (AD) enterprise app with System for Cross-domain Identity Management (SCIM) provisioning. When done, you will have enabled an enterprise app with provisioning to securely automate and manage user identity information, such as user account creation, updates, and deactivation, between Azure AD and StrongDM.

Prerequisites

Before you begin, ensure that you have the appropriate roles:

  • In Azure AD, you must be assigned one of the following roles: Application Administrator, Cloud Application Administrator, or Global Administrator.
  • In StrongDM, you must be an Account Administrator.

Azure AD SCIM Application Setup Guide

Create an enterprise application

  1. Log in to the Azure Active Directory portal.
  2. Go to Manage > Enterprise Applications in the left pane, and click + New application to create a new enterprise application.
  3. Click + Create your own application.
  4. Enter a descriptive name for your app, and then select Integrate any other application you don’t find in the gallery (Non-gallery) because you’ll be creating your own application instead of using a published gallery app.

Set up provisioning

  1. Go to the app’s Provisioning section.

  2. Click Get Started.

  3. In the provisioning properties, set the following:

    1. Provisioning Mode: Set to Automatic.

    2. Tenant URL: Set https://app.strongdm.com/provisioning/azure/v2

    3. Secret Token: Get the StrongDM SCIM token by following these steps:

      1. Go to the StrongDM Admin UI’s Settings > User Management > Provisioning section.
      2. Set the SCIM Provider option to Azure.
      3. Click Activate SCIM and then copy and save the token generated. The token displays one time only.
      4. Go back to your Azure console and fill the Secret Token field with the token you copied.

      For example: aabb12fjfl445...jkhksjhf98345un

    In this step, you are using the HTTP Header authentication method and providing a bearer token to access your SCIM implementation.

  4. Click Test Connection to test whether the new app can connect to your SCIM API. If there are errors, make sure your tenant URL and secret token are correct and try again.

  5. Click Save.

Customize user provisioning attribute mappings

  1. Go back to the app’s Provisioning blade, and expand Mappings to view and edit the User attributes that flow between Azure AD and the target application.
  2. Edit the User Mappings one by one by deleting all attributes except for the following:
    1. userName
    2. active
    3. name.givenName
    4. name.familyName
    5. name.formatted
  3. Edit the Group Mappings in the same way by deleting all attributes except for the following:
    1. displayName
    2. members
  4. Set Provisioning Status to On.

Manual SCIM provisioning setup is now complete.

Information About User Management in StrongDM

In addition to managing Users and Roles through Azure AD, you have the flexibility to continue managing your Users and Roles directly through StrongDM.

Here’s what you can do:

  • Manually create Users, Service Accounts, and Roles within StrongDM—these will be identified with the sdm badge in the Admin UI indicating that they are “StrongDM Managed.”
  • Attach StrongDM-managed Users and Service Accounts to both StrongDM-managed Roles and Azure AD-managed Roles from within StrongDM.
  • Attach Azure AD-managed Users to StrongDM-managed Roles from within StrongDM.
  • Set Permission Levels for Users within the Admin UI for both StrongDM-managed and Azure AD-managed users.
  • Grant access through Roles and Temporary Access for Users from within StrongDM.

Caveats and limitations

Due to the nature of how Azure AD integrates through SCIM 2.0, there are a few limitations to be aware of.

If a User is deleted in Azure AD, the following will happen:

  • The User will be suspended in StrongDM.
  • The User will be unassigned from all Roles.

If that same User is restored in Azure AD, the following will happen:

  • The User’s status will change from “suspended” to “active” within StrongDM.
  • The User will be assigned to any Roles that are assigned to them in Azure AD.
  • The User’s Permission Level will be restored to “User.”

Options to avoid

Azure AD does not support syncing Users contained within a nested group. The result of doing so will be that the group will sync into a Role within StrongDM but any Users in the Azure AD-nested group will not be created in StrongDM.