DeepFabric
Back to home

Microsoft Entra ID SCIM setup

DeepFabric supports System for Cross-domain Identity Management (SCIM) with Microsoft Entra ID (Azure Active Directory) for automated user provisioning and deprovisioning. This integration streamlines user management by synchronizing user accounts between Entra ID and DeepFabric, ensuring secure access control and operational efficiency.

Overview

SCIM (System for Cross-domain Identity Management) is an open standard that allows for automated user provisioning between identity providers (like Entra ID) and applications (like DeepFabric). Using SCIM with DeepFabric enables:

  • Automatic user creation when assigned in Entra ID
  • Profile updates synchronized to DeepFabric
  • Automatic deactivation when users are unassigned or deleted in Entra ID
  • Group membership synchronization

Setup Guide

Prerequisites

  1. A Microsoft Entra ID (Azure AD) tenant with administrator access
  2. DeepFabric Enterprise account with SCIM integration capabilities
  3. Admin privileges in your DeepFabric organization

Configuration Steps

Step 1: Obtain SCIM Endpoint and Token from DeepFabric

  1. Navigate to [Profile Icon] > Organizations > [Organization Name] > Identity Management
  2. Toggle the Enable SCIM switch to On under Dashboard tab.

azure-ad-scim-tokens

  1. You can copy your SCIM Base URL from Dashboard tab.

azure-ad-scim-tokens

  1. You can generate your new Token (Bearer Authentication) from Auth Tokens tab.

azure-ad-scim-tokens

Your Token is copied to your clipboard upon generation. Make sure to save it in a secure location as it will be used in the next step.

Step 2: Configure Microsoft Entra ID (Azure AD)

  1. Sign in to the Azure portal
  2. Navigate to Microsoft Entra ID > Enterprise applications, and click on + New application in the command bar.
  3. You'll be redirected to Microsoft Entra Gallery. In this screen, select + Create your own application in the command bar.
  4. Provide a name (Ex: DeepFabric) and select Integrate any other application you don't find in the gallery

azure-ad-scim-application

  1. Once created, select Provisioning blade from the left sidebar.

Starting March 2025, Entra ID users are redirected to a new provisioning user experience.

  1. In the Command bar, click on + New configuration
  2. You'll be redirected to a wizard for creating a New Provisioning Configuration. Under Admin Credentials section, fill the following fields:
    • Tenant URL: Enter your DeepFabric SCIM Base URL
    • Secret Token: Enter your DeepFabric API Token
  3. Click Test Connection to verify the configuration

azure-ad-scim-test-connection

  1. If the test connection is successful, click on Create button. After successful creation, you will be taken to the configuration details page to manage advanced settings.

Step 3: Verify Attribute Mappings

  1. From the left sidebar, select Attribute mapping (Preview) blade.
  2. By default, attribute mappings are created on two resource types:
    • User (view mappings by clicking on Provision Microsoft Entra ID Users link)
    • Group (view mappings by clicking on Provision Microsoft Entra ID Groups link)
  3. For User resource type, ensure that the following attributes are mapped:
    • externalId → mailNickname
    • userName → userPrincipalName
    • ...other attributes
  4. For Group resource type, ensure that the following attributes are mapped:
    • externalId → objectId
    • displayName → displayName
    • ...other attributes

Step 4: Start Provisioning

  1. Return to the Overview page.
  2. In the command bar, click on Start provisioning button to begin an immediate sync.

azure-ad-scim-start-provisioning

Verification

After configuration, Entra ID will begin synchronizing users based on your settings. To verify:

  1. Assign a test user to the DeepFabric application in Entra ID
  2. Wait for the provisioning cycle to complete (may take up to 40 minutes for the initial sync)
  3. Check DeepFabric to confirm the user has been created with the correct attributes
  4. Test deprovisioning by removing the application assignment in Entra ID

azure-ad-scim-verify

Troubleshooting

Common Issues

  • Connection Errors: Verify your SCIM URL and token are correct
  • User Not Provisioned: Check if the user is properly assigned to the DeepFabric application in Entra ID
  • Attribute Mapping Issues: Review provisioning logs in Entra ID for specific error messages

Getting Help

If you encounter issues with your SCIM integration, please contact DeepFabric Support at support@deepfabric.ai or your dedicated account manager.