--- title: "SCIM in Azure Active Directory" slug: "configure-scim-in-azure-ad" updated: 2025-06-26T21:20:04Z published: 2025-06-26T21:20:04Z canonical: "docs.processmaker.com/configure-scim-in-azure-ad" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.processmaker.com/llms.txt > Use this file to discover all available pages before exploring further. # SCIM in Azure Active Directory The System for Cross-domain Identity Management (SCIM) is an open standard designed to automate user identity management across cloud-based applications and services. By integrating SCIM with Azure Active Directory (Azure AD), organizations can streamline the provisioning and deprovisioning of user accounts between Azure AD and external platforms such as ProcessMaker. Configuring SCIM ensures that user and group information is consistently maintained across systems, reducing administrative overhead and enhancing security. Once enabled, Azure AD automatically manages user lifecycles, including creation, updates, and deletion, within the connected application based on changes in the directory. ### Prerequisites for SCIM Setup in Azure To successfully configure SCIM provisioning for ProcessMaker in Azure AD, you will need: - An Azure AD application (either custom-built or sourced from the gallery). - The SCIM endpoint URL provided by ProcessMaker. - A bearer token for secure authentication with ProcessMaker’s SCIM API. - Assigned users or groups in Azure AD to be provisioned. - Customized attribute mappings to align Azure AD fields with ProcessMaker user schema. This setting is optional. > [!WARNING] > Azure Active Directory Configuration > > To assign groups to an application for SCIM provisioning, ensure that your Azure Active Directory configuration supports group assignments. This capability may depend on your organization's Azure AD settings or subscription features. --- ## Access Azure and Create the SCIM Application ### Step 1: Create the Application in Azure 1. Sign in to [Azure Portal](https://portal.azure.com/). 2. Navigate to the **Azure Active Directory** section from the left-hand menu. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Azure Active Directory.png) 3. Under **Manage**, select **Enterprise applications**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Enterprise applications.png) 4. Click **+ New application**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/New Application.png) 5. Select **Create your own application**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Create your own application.png) 6. Enter a name for the application (e.g., `SCIM - ProcessMaker`) and choose **Integrate any other application you don't find in the gallery**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/App Name(1).png) 7. Click **Create** to generate the custom enterprise application. --- ### Step 2: Assign Users or Groups 1. In your newly created application, go to **Users and groups**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Users and groups.png) 2. Click **+ Add user/group**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Add user_group.png) 3. Create users or groups as needed within Azure AD. 4. Select the users and/or groups you want to provision to ProcessMaker. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Select Users-Groups.png) 5. Click **Assign**. > [!NOTE] > 📌**Note:** Ensure group assignment capabilities are available in your Azure AD configuration. --- ### Step 3: Configure Provisioning 1. In the app's side panel, select **Provisioning**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Provisioning.png) 2. Click the **Get Started** tab if this is your first time setting up provisioning. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Get Started .png) 3. Under **Provisioning Mode**, select **Automatic**. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Provisioning Mode.png) #### SCIM Attribute Mappings Both users and groups have a standard set of attributes that Azure can send, using the SCIM 2.0 format. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Mappings.png) #### Group Attributes | SCIM Attribute | Description | | --- | --- | | `displayName` | Group name (required). | | `members` | List of user references (SCIM IDs). | | `externalId` | Optional external group identifier. | #### User Attributes | SCIM Attribute | Description | | --- | --- | | `userName` | Unique username (typically an email). | | `name.givenName` | First name. | | `name.familyName` | Last name. | | `displayName` | Full or preferred display name. | | `emails[type eq "work"].value` | Work email address. | | `active` | Whether the account is active. | | `externalId` | Optional external user ID. | | `title` | Job title. | | `department` | Department or unit. | | `phoneNumbers[type eq "work"].value` | Work phone number. | | `preferredLanguage` | Language preference (e.g., `en-US`). | | `groups` | Groups the user belongs to. | --- ### Step 4: Activate SCIM Provisioning To connect Azure AD with ProcessMaker, you’ll need specific details from your ProcessMaker instance: 1. In the Azure SCIM app’s **Provisioning** section, locate the **Admin Credentials** panel. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Admin Credentials.png) 2. Enter the following: - **Tenant URL**: This is the SCIM Base URL provided by ProcessMaker. Example: `https://yourdomain.processmaker.net/scim/v2` - **Secret Token**: A bearer token generated in ProcessMaker to authorize Azure’s SCIM requests. > [!WARNING] > 📌**Note:** Be sure to copy and paste the token exactly as provided—tokens are case-sensitive and must not include extra spaces. --- ### Step 5: Test the Connection 1. Click **Test Connection**. 2. If successful, Azure will display a confirmation message indicating the SCIM endpoint is reachable and authorized. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Test Connection.png) 3. Once validated, click **Save** to store the configuration. --- ### Step 6: Start Provisioning 1. Click **Start Provisioning** to begin automatic synchronization of users and groups. 2. Azure AD will immediately initiate the provisioning process. 3. Go to **Provisioning Logs** to monitor sync activity, errors, and user-level provisioning results. ![](https://cdn.document360.io/2d311614-fcb7-4424-8b4c-d4d3091eebeb/Images/Documentation/Provisioning Logs.png) > [!NOTE] > 📌 **Note:** Azure AD performs SCIM synchronization approximately **every 40 minutes** by default. --- ## Verify in ProcessMaker After synchronization begins, log into your ProcessMaker instance to confirm the following: - User accounts and groups are created automatically. - Any changes in Azure (e.g., name updates, deactivations) are reflected in ProcessMaker. - Group membership and role assignments align with your configuration. > [!NOTE] > 💡 **Helpful Tips** > > - Only users and groups assigned to the SCIM application in Azure AD will be synchronized. > - You can customize attribute mappings to match fields such as email, name, role, and department according to your ProcessMaker configuration. > - Use ProcessMaker's user management interface to confirm attributes like username, email, and group membership are provisioned correctly. > - If synchronization fails, check the SCIM endpoint URL and bearer token for formatting issues—incorrect entries are a common cause of provisioning errors. > [!WARNING] > Behavior and Constraints > > For important details about provisioning behavior and limitations, see [On-demand provisioning in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/provision-on-demand?utm_source=chatgpt.com&pivots=app-provisioning) by Microsoft.