> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/security/identity-providers-sso/scim-configurations/microsoft-entra-id-scim-configuration.md).

# Microsoft Entra ID - SCIM - Configuration

{% hint style="success" %}

#### Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.
{% endhint %}

## ![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FSxcnKlaJKPzDqONWoDNv%2FSummary2-Small-Icon.svg?alt=media\&token=5e3253d0-a069-4ba5-9c06-83c70bd0b21d) Overview

This article provides details on configuring an Entra ID identity provider to use Flosum's SCIM API. For more information about SCIM, see the following article.

* [Configuring SCIM for Flosum](/global-settings/security/identity-providers-sso/configuring-scim-for-flosum.md)

{% hint style="warning" %}

#### Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any **Flosum Hosted URLs** with your own URLs.
{% endhint %}

## Prerequisites

Before setting up automated provisioning, ensure SAML-based SSO is properly configured and fully functional in your Flosum tenant.

Ensure your **SAML Attributes & Claims** configuration includes the following attributes:

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FoCInfQodq2t2msKVB6Gd%2FUsingJitProvisioning-Azure-01.png?alt=media&amp;token=341b9789-2f46-433c-b14d-97816e6a9ceb" alt="" width="563"><figcaption></figcaption></figure></div>

| Claim Name   | Value          |
| ------------ | -------------- |
| userUniqueId | user.objectid  |
| firstName    | user.givenname |
| lastName     | user.surname   |
| email        | user.mail      |

For instructions for adding and configuring a Microsoft Entra ID identity provider, see the following articles.

* [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
* [Microsoft Entra ID - OIDC - Configuration](/global-settings/security/identity-providers-sso/oidc-identity-providers/microsoft-entra-id-oidc-configuration.md)
* [Microsoft Entra ID - SAML - Configuration](/global-settings/security/identity-providers-sso/saml-identity-providers/microsoft-entra-id-saml-configuration.md)

## Configure Entra ID

{% stepper %}
{% step %}

### Configure API Integration

1. Log in to your Entra ID account.
2. Access the identity provider you created.
3. Click **Provisioning** under **Manage** in the left sidebar menu.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FHzu22O2vEM1k36WsbwoD%2FConfiguringScim-MsEntra-S01-01.png?alt=media&amp;token=d59fb06e-c47e-4d2b-9df2-12ddf931310d" alt="" width="563"><figcaption></figcaption></figure></div>
4. Change **Provisioning Mode** from **Manual** to **Automatic**.
5. Complete the **Admin credentials** section.
6. **Tenant URL**: Enter the SCIM API URL for your region from the table below.

<table><thead><tr><th width="159.6666259765625">Region</th><th>SCIM API URL</th></tr></thead><tbody><tr><td>United States</td><td>https://global-us.flosum.app/api/v1/scim</td></tr><tr><td>Germany</td><td>https://global-de.flosum.app/api/v1/scim</td></tr><tr><td>Japan</td><td>https://global-jp.flosum.app/api/v1/scim</td></tr><tr><td>Australia</td><td>https://global-au.flosum.app/api/v1/scim</td></tr></tbody></table>

7. **Secret token**: Enter your Global Settings **API Token**. If you don't have an API Token, see the following article for instructions on creating one.
   1. [Creating an API Token](/global-settings/security/api-tokens/creating-an-api-token.md)
8. Click **Test connection** to verify that a connection to your Flosum tenant can be established.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FM0LMh4tRYs8u6DAZP52l%2FConfiguringScim-MsEntra-S01-02.png?alt=media&amp;token=240c857e-22e1-49bd-8ff8-200ce43d17a2" alt="" width="563"><figcaption></figcaption></figure></div>

{% hint style="info" %}
If you don't receive a connection confirmation, check the **Tenant URL** and ensure it isn't blocked by firewalls or other network traffic interceptors. Then verify that the **API Token** is correct.

![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FUgJcnuoNMs325Imo3t42%2FConfiguringScim-MsEntra-S02-02.png?alt=media\&token=413a060e-56b2-474a-93f6-626392667ebb)
{% endhint %}

9. Click **Save**.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2Fy4ghmBeZgfjSSP7flr16%2FConfiguringScim-MsEntra-S02-03.png?alt=media&amp;token=64d6d31d-5530-4e70-96d4-53d8e1d69e29" alt="" width="548"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### User Mappings

The Flosum SCIM API uses specific metadata values from Entra ID user profiles. This section explains the required mappings between Flosum SCIM API and Entra ID attributes.

1. Click **Provisioning** under **Manage** in the left sidebar menu.&#x20;
2. Click **Provision Microsoft Entra ID Users** in the **Mappings** section.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2F0WPat5u1UZSp0svSSeG9%2FConfiguringScim-MsEntra-S03-01.png?alt=media&amp;token=d3435aee-7178-4aec-820c-88e2df0566f2" alt="" width="563"><figcaption></figcaption></figure></div>
3. Ensure **Enabled** is set to **Yes**.
4. Ensure all **Target Object Actions** (**Create**, **Update**, and **Delete**) are checked.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FmekMhTChVN6L0IWD73If%2FConfiguringScim-MsEntra-S03-02.png?alt=media&amp;token=6dd271b9-feff-4a30-bad0-51a6ee096a33" alt="" width="563"><figcaption></figcaption></figure></div>
5. If any changes were made, click **Save**.
6. Attribute mappings define which Microsoft Entra ID attributes are synchronized with which Flosum SCIM API attributes. See the screenshot and table below on how to set the correct attribute mappings.

<figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FhmA6WLv94oDCMAXjuc5Y%2FConfiguringScim-MsEntra-S03-03.png?alt=media&amp;token=b5971f68-e5d4-49c4-a7b4-71a03c3580ac" alt=""><figcaption></figcaption></figure>

<table><thead><tr><th width="260.3333740234375">Flosum SCIM API Attribute</th><th>Microsoft Entra ID Attribute</th></tr></thead><tbody><tr><td>userName</td><td>mail</td></tr><tr><td>active</td><td>Switch([IsSoftDeleted],,"False","True","True","False")</td></tr><tr><td>emails[type eq "work"].value</td><td>mail</td></tr><tr><td>name.givenName</td><td>givenName</td></tr><tr><td>name.familyName</td><td>surname</td></tr><tr><td>externalId</td><td>objectId</td></tr></tbody></table>

{% hint style="warning" %}
Flosum uses the email address as the username. Make sure the `userName` attribute is mapped to the `mail` attribute. The screenshot below shows how to edit the **mail** attribute to set up this mapping.

![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2F1Vquc2ymSPdrEBcxF5J5%2FConfiguringScim-MsEntra-S03-04.png?alt=media\&token=229e2973-c761-4da9-9110-9be66506d76e)
{% endhint %}

{% hint style="info" %}
During user provisioning, the timezone attribute is set to Etc/UTC by default.
{% endhint %}
{% endstep %}

{% step %}

### Group Mappings

The Flosum SCIM API does not currently support group provisioning. Make sure Group synchronization is disabled.

1. Click **Provisioning** under **Manage** in the left sidebar menu.&#x20;
2. Click **Provision Microsoft Entra ID Groups** in the **Mappings** section.
3. Ensure **Enabled** is set to **No**.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FsUfpPNDJNQS4jJHJq9ss%2FConfiguringScim-MsEntra-S04-01.png?alt=media&amp;token=abf6e51f-b3fe-4614-884a-783976d34146" alt="" width="563"><figcaption></figcaption></figure></div>
4. If any changes were made, click **Save**.
   {% endstep %}

{% step %}

### Start Provisioning

Once you have configured Entra ID to work with Flosum's SCIM API, you can turn on Provisioning in Entra ID to start the process of provisioning users.

1. Click **Provisioning** under **Manage** in the left sidebar menu.
2. In the **Settings** section, toggle the **Provisioning Status** to **On**.&#x20;

   <div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FqnPEKLGyDC23B3GI3gOB%2FConfiguringScim-MsEntra-S05-01.png?alt=media&amp;token=10f8408c-4a11-40c5-b369-4a87ea8dc275" alt="" width="563"><figcaption></figcaption></figure></div>
3. Click **Save**.&#x20;

{% hint style="info" %}
This will begin the initial provisioning, which may take some time. Check the bottom of the page in about 20 minutes to see the status.
{% endhint %}

**Disable Provisioning**

Provisioning can be disabled by changing the **Provisioning Status** to **Off**.

{% hint style="info" %}
If you need an urgent update, stop provisioning and restart it. This will trigger an immediate resync that includes all updates.
{% endhint %}
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/global-settings/security/identity-providers-sso/scim-configurations/microsoft-entra-id-scim-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.