How to set up SCIM integration with Microsoft Entra ID

Below are steps that will help you synchronize logins in the Dashboard with Microsoft Entra ID:

1. Navigate to Account settings - API in your Controlio Dashboard
2. Create a new API token with required name and lifetime
3. Copy and save the generated token (you’ll need it later in this guide)
   
   
    
4. Go to portal.azure.com and login to the portal with an account that has permission to modify Enterprise applications
5. Navigate to Microsoft Entra ID - Enterprice applications
6. reate a new app by pressing the button New application
   
   
    
7. Press the button Create your own application, or choose an existing application (you may use the same application you are using for SSO integration with Controlio)
   
   
    
8. Name the application and select Integrate any other application you don't find in the gallery (Non-gallery), then click on Create
   
   
    
9. If you have an existing application just click on its name to get to the application overview page
10. Navigate to Manage - Provisioning
    
    
     
11. Click on + New configuration
    
    
     
12. Set Select authentication method to Bearer authentication
13. Set the Tenant URL to https://backend.controlio.net/scim/v2 (https://your-host/scim/v2 for On-Premise)
14. For the Secret token, paste the API token you stored on step 3
15. Click on Test connection to check if you can connect to the Dashboard
16. The Create button will turn blue if the test was successful, so click on it to create the Provisioning
    
    
     
17. Navigate to Manage - Provisioning - Mappings - Provision Microsoft Entra ID Groups, and disable it. (groups aren't supported by Controlio SCIM integration yet)
    
    
    
     
18. Navigate to Manage - Attribute mapping
19. Set up the attribute mapping as follows:
    Source attribute -> userPrincipalName
    Target attribute -> userName
    Matching precedence -> 2
    Match objects using this attribute -> Yes
    
    
    
    Source attribute -> objectId
    Target attribute -> externalId 
    Matching precedence -> 1
    Match objects using this attribute -> Yes
    
    
     
20. After adding the above attributes, click on Save to apply the changes
    
    
     
21. Navigate to Manage - Users and groups
22. Click on + Addd user/group to assign users to the provisioning
    
    
     
23. Navigate back to the Overview, and click on Provision on demand
24. Select the user you added in step 22 to test the provisioning
    
    
     
25. If the provisioning was successful, the login will be created in the Controlio Dashboard. You may check that on SYSTEM - Access - Logins
26. Once you have confirmed that the provisioning was successful, you may enable the synchronization on the same Overview page by clicking on Start provisioning