SCIM (System for Cross-domain Identity Management) is an open standard that automates user account management. With SCIM, users are automatically synchronized between Microsoft Entra ID (formerly Azure Active Directory) and Safeguard. This reduces manual work and increases security by ensuring accounts are promptly created, updated, or deactivated.
Follow the steps below to configure SCIM for Safeguard in Microsoft Entra ID.
Supported features
With SCIM in Safeguard you can:
Automatically provision new users.
Update user attributes.
Automatically deprovision users when they are removed from Microsoft Entra ID.
Manage group assignments in the identity provider.
Step 1 — Request SCIM activation
Send an email to our support team at [email protected] to request SCIM activation for your organization.
Our support team will provide you with an API key, which you will need for configuration in Microsoft Entra ID.
Step 2 — Create or select an application in Microsoft Entra ID
In Microsoft Entra ID, go to Enterprise apps.
Check if a Safeguard application already exists.
Not yet created? Create a new Enterprise application and give it a clear name, such as Safeguard.
Already exists? Select the existing application.
Step 3 — Configure Provisioning
In the application menu, click on Provisioning.
Click on New configuration.
Enter the following under Tenant URL:
Under Secret Token, paste the API key you received from Safeguard support.
Click Test Connection — once successful, click Create.
Step 4 — Set up user Mappings
Go to Manage > Provisioning > Mappings.
Click on Provision Microsoft Entra ID Users and configure the following attribute mappings:
App Attribute | Microsoft Entra ID Attribute |
userName | userPrincipalName |
active | Switch([IsSoftDeleted], , “False”, “True”, “True”, “False”) |
displayName | displayName |
preferredLanguage | preferredLanguage |
phoneNumbers[type eq "work"].value | telephoneNumber |
externalId | For externalId choose your own (this is optional) |
Click Save to confirm your changes.
Step 5 — Set up group Mappings
Go to Manage > Provisioning > Mappings.
Click on Provision Microsoft Entra ID Groups
If you do not need group provisioning disable it here en go to Step 6
Configure the following attribute mappings:
App Attribute | Microsoft Entra ID Attribute |
displayName | displayName |
externalId | For externalId choose your own (this is optional) |
members | members |
Click Save to confirm your changes.
Step 6 — Start provisioning
Go to Overview
Click on Start provisioning.
Provisioning is now active.
Check the status in the overview to see if the Initial cycle completes without issues.