Set up a SCIM Provisioning App in Microsoft Entra ID

Last modified on March 11, 2024

User provisioning provides you with the ability to continue to manage your organization’s users in one place, and have those users populate into StrongDM. Provisioning prevents the need to create a duplicate set of users in StrongDM that already exist in your identity management service. When provisioning users, the users are set up in the external service and are then synced to StrongDM. The provisioned users are not able to be individually edited within StrongDM. Changes to provisioned users are made at the source and are synced to StrongDM afterward. These users in StrongDM are given access to resources in the same manner as native users: by assigning them to roles that contain the desired access permissions.

This guide will show you how to set up a Microsoft Entra ID (formerly Azure AD) enterprise app with System for Cross-domain Identity Management (SCIM) provisioning. When done, you will have enabled an enterprise app with provisioning to securely automate and manage user identity information, such as user account creation, updates, and deactivation, between Microsoft Entra ID (formerly Azure AD) and StrongDM.

Prerequisites

Before you begin, ensure that you have the appropriate roles:

  • In Microsoft Entra ID (formerly Azure AD), you must be assigned one of the following roles: Application Administrator, Cloud Application Administrator, or Global Administrator.
  • In StrongDM, you must be an Account Administrator.

Microsoft Entra ID SCIM Application Setup Guide

Create an enterprise application

  1. Log in to the Azure portal.
  2. Go to Manage > Enterprise Applications in the left pane, and click + New application to create a new enterprise application.
  3. Click + Create your own application.
  4. Enter a descriptive name for your app, and then select Integrate any other application you don’t find in the gallery (Non-gallery) because you’ll be creating your own application instead of using a published gallery app.

Set up provisioning

  1. Go to the app’s Provisioning section.

  2. Click Get Started.

  3. In the provisioning properties, set the following:

    1. Provisioning Mode: Set to Automatic.

    2. Tenant URL: Set https://app.strongdm.com/provisioning/azure/v2

    3. Secret Token: Get the StrongDM SCIM token by following these steps:

      1. Go to the StrongDM Admin UI’s Settings > User Management > Provisioning section.
      2. Set the SCIM Provider option to Azure.
      3. Click Activate SCIM and then copy and save the token generated. The token displays one time only.
      4. Go back to your Azure console and fill the Secret Token field with the token you copied.

      For example: aabb12fjfl445...jkhksjhf98345un

    In this step, you are using the HTTP Header authentication method and providing a bearer token to access your SCIM implementation.

  4. Click Test Connection to test whether the new app can connect to your SCIM API. If there are errors, make sure your tenant URL and secret token are correct and try again.

  5. Click Save.

You also need to decide how you want your user information to sync with StrongDM. Under Provisioning > Settings > Scope are the choices Sync all users and groups and Sync only assigned users and groups.

  • Sync all users and groups syncs your entire Active Directory with StrongDM, and no users or groups need to be configured within this app.

  • Sync only assigned users and groups is the default behavior, and requires you to create the relevant groups under Users and Groups within this app. With this option selected, only the entities that are listed in Users and Groups are synced.

Customize user provisioning attribute mappings

  1. Go back to the app’s Provisioning blade, and expand Mappings to view and edit the User attributes that flow between Microsoft Entra ID (formerly Azure AD) and the target application.
  2. Edit the User Mappings one by one by deleting all attributes except for the following:
    1. userName
    2. active
    3. name.givenName
    4. name.familyName
    5. name.formatted
  3. Edit the Group Mappings in the same way by deleting all attributes except for the following:
    1. displayName
    2. members
  4. Set Provisioning Status to On.

Manual SCIM provisioning setup is now complete.

Remote Identities

If you intend to use Remote Identities for your users, you can send a user’s Remote Identity value from Entra ID. To do this, create a custom attribute in Entra ID for the Remote Identity value, and map that to the defaultRemoteIdentity attribute on the StrongDM side.

Information About User Management in StrongDM

In addition to managing Users and Roles through Microsoft Entra ID (formerly Azure AD), you have the flexibility to continue managing your Users and Roles directly through StrongDM.

Here’s what you can do:

  • Manually create Users, Service Accounts, and Roles within StrongDM—these will be identified with the sdm badge in the Admin UI indicating that they are “StrongDM Managed.”
  • Attach StrongDM-managed Users and Service Accounts to Roles managed by both StrongDM and Microsoft Entra ID (formerly Azure AD) from within StrongDM.
  • Attach Users managed by Microsoft Entra ID (formerly Azure AD) to StrongDM-managed Roles from within StrongDM.
  • Set Permission Levels for Users within the Admin UI for users managed by both StrongDM and Microsoft Entra ID (formerly Azure AD).
  • Grant access through Roles and Temporary Access for Users from within StrongDM.

Caveats and limitations

Due to the nature of how Microsoft Entra ID (formerly Azure AD) integrates through SCIM 2.0, there are a few limitations to be aware of.

If a User is deleted in Microsoft Entra ID (formerly Azure AD), the following will happen:

  • The User will be suspended in StrongDM.
  • The User will be unassigned from all Roles.

If that same User is restored in Microsoft Entra ID (formerly Azure AD), the following will happen:

  • The User’s status will change from “suspended” to “active” within StrongDM.
  • The User will be assigned to any Roles that are assigned to them in Microsoft Entra ID (formerly Azure AD).
  • The User’s Permission Level will be restored to “User.”

Options to avoid

Azure AD does not support syncing Users contained within a nested group. The result of doing so will be that the group will sync into a Role within StrongDM but any Users in the Microsoft Entra ID (formerly Azure AD) nested group will not be created in StrongDM.