Skip to main content

SCIM Integration with Microsoft Entra ID

Provision Arcules users and groups from Microsoft Entra ID

This article explains how to set up SCIM provisioning from Microsoft Entra ID to the Arcules Web Platform. For background on SCIM, token management and how provisioned users behave, see SCIM Provisioning Overview.

For single sign-on with Entra ID (SAML 2.0), see Setting up SSO for your organization.

Setup Overview

Setting up SCIM provisioning from Microsoft Entra ID takes five steps:

  1. Enable SCIM in the Arcules Web Portal with Microsoft Entra ID selected.

  2. Create an Enterprise Application for Arcules in Entra ID.

  3. Configure provisioning with the Arcules Tenant URL and Secret Token.

  4. Configure the attribute mappings and matching.

  5. Assign users and groups, and start provisioning.

Before you begin

In the Arcules Web Portal, enable SCIM and select Microsoft Entra ID as the identity provider. Copy the URL and Secret Token: you'll need both in Entra ID. The Secret Token is only shown once.

For step-by-step instructions, and for how to refresh the token later, see SCIM Provisioning Overview › Enabling SCIM.

SCIM configuration in Microsoft Entra ID

Create the Service Provider Application

  1. From the Microsoft Entra admin center, on the left menu, open the Identity > Applications menu, then click on the sub menu called Enterprise Applications:

  2. Click on the + New Application button:

  3. Click on the + Create your own application button:

  4. Add the name you wish for your application on the What's the name of your app? input field, and also select the third radio button option: Integrate any other application you don't find in the gallery (Non-gallery):

  5. Finally, click on the Create button located at the bottom of the page:

  6. Once the application has been created successfully you should see the following screen:

Tenant URL & Secret Token Configuration

  1. From the Microsoft Entra admin center, on the left menu, open the Identity > Applications menu, then click on the sub menu called Enterprise Applications, and select the recently created application:

  2. When entering the application information, you will see the Overview section:

  3. Under Provision User Accounts, click Get started:

  4. You will see the other Overview section, click on the Get started button:

  5. On the Provisioning Mode, select Automatic:

  6. Under the Admin Credentials section set the information like this:

    1. Tenant URL: paste the URL you copied from the Arcules Web Portal (see Before you begin).

    2. Secret Token: paste the Secret Token you copied from the Arcules Web Portal.

      Note: The Tenant URL ends with the flag aadOptscim062020. This flag is required for Entra ID: without it, some features such as soft deletion won't work correctly. Arcules only adds it when Microsoft Entra ID is selected as the identity provider. More information can be found here.

  7. Click the Test Connection button. You should see a confirmation that the SCIM connection is successful.

  8. Click the Save button.

How Matching Works

Before creating a user or group, Entra ID checks whether it already exists in Arcules using the matching attributes you configure. If it finds a match, it links to the existing user or group instead of creating a duplicate.

We recommend matching on externalId first, mapped to Entra ID's objectId, which never changes. This way users and groups are still found after an email, UPN or group-name change.

Groups Mapping Attributes

  1. From the Microsoft Entra admin center, on the left menu, open the Identity > Applications menu, then click on the sub menu called Enterprise Applications, and select the recently created application. You will see the Overview screen, then select the Provisioning option:

  2. In the Provisioning screen, select the option Edit attribute mappings:

  3. Select the Mappings option:

  4. In the Mappings section select Provision Microsoft Entra ID Groups:

  5. Configure the mappings to match the table below, and delete any other mappings in the list.

    1. To edit a mapping, click the attribute to open Edit Attribute To add one, click Add New Mapping

    2. To set matching, in Edit Attribute set Match objects using this attribute to Yes and enter the Matching precedence.

      Note 1: Attribute mappings define how attributes are synchronized between Microsoft Entra ID and customappsso.

      Note 2: customappsso refers to the Arcules application in Entra ID.

customappsso (Arcules) Attribute

Microsoft Entra ID Attribute

Matching Precedence

externalId

objectId

1

displayName

displayName

2

members

members

-

After finishing configuring the group mappings, click on the Save button.

Users Mapping Attributes

  1. Go back to the Provisioning section, and select the Provision Microsoft Entra ID Users option:

  2. Configure your mappings to match the table below, and delete any other mappings in the list, such as emails[type eq "work"].value, title, addresses and phoneNumbers. Set matching the same way as for groups.

customappsso (Arcules) Attribute

Microsoft Entra ID Attribute

Mapping Type

Matching Precendence

externalId

objectId

Direct

1

userName

userPrincipalName

Direct

2

active

Switch([IsSoftDeleted], , "False", "true", "True", "false")

Expression

-

preferredLanguage

preferredLanguage

Direct

-

name.givenName

givenName

Direct

-

name.familyName

surname

Direct

-

name.formatted

Join(" ", [givenName], [surname])

Expression

-

Note 1: For the current version, the userName represents the email (this is enforced in Entra ID, and it is used as the email field when creating a user).

Note 2: Mappings with the Expression type (active and name.formatted) are created by setting Mapping type to Expression in Edit Attribute. For more information about expressions, see Reference for writing expressions for attribute mappings in Microsoft Entra ID.

Assign users and groups and start provisioning

Entra ID only provisions the users and groups assigned to the Arcules application.

1. From the Microsoft Entra admin center, open the Arcules application and select Users and groups > + Add user/group.

2. Select the users and groups that should have access to Arcules and click Assign.

Note: Assigning a group provisions the group and its direct members. Members of nested groups are not provisioned.

3. Go to Provisioning and expand Settings. Set Scope to Sync only assigned users and groups.

4. Set Provisioning Status to On and click Save.

The first provisioning cycle starts within a few minutes. After that, Entra ID syncs changes about every 40 minutes.

Tip: To test with a single user before the first cycle completes, use Provision on demand in the application's menu.

Removing Users via SCIM

Entra ID supports two ways to remove a user from Arcules via SCIM, and the method used depends on how the user is removed in Entra ID:

  • Deactivate user: If a user is unassigned from the Arcules enterprise application in Entra ID, Entra ID sends a request to Arcules, which deactivates the user but does not delete them.

  • Delete user: If a user is fully deleted from Entra ID and permanently purged, Entra ID sends a delete request to Arcules, which removes the user entirely.

To completely delete a user in Arcules, follow these steps:

  1. In the Microsoft Entra admin center, navigate to the user and delete the user — do not just unassign them from the Arcules app.

  2. Go to Deleted Users in Entra ID and permanently delete the user from there as well. This second step is what causes Entra ID to send the delete request to Arcules. Without it, Entra ID will only send a deactivate request.

  3. Wait for the next provisioning cycle to run (approximately every 40 minutes). The deletion will sync to Arcules at that point.

Note: If the user already exists in Arcules and provisioning is already enabled, you do not need to re-provision the user before deleting them. Skip directly to the delete steps above.

Troubleshooting

Symptom

Cause

Fix

Nothing is provisioned / "Initial cycle not run"

No users or groups assigned, or Provisioning Status is Off

See Assign users and groups and start provisioning

Provisioning logs show invalidFilter (HTTP 400)

A matching attribute that Arcules can't search on, e.g. an emails[...] mapping

Match only on externalId, userName and (for groups) displayName

Test Connection fails with 401

Wrong, expired or refreshed token

Refresh the token in Arcules and paste the new one

Users are deactivated but not deleted

The user was only unassigned, or not purged from Deleted Users

See Removing Users via SCIM

Did this answer your question?