Configure Your SCIM - Azure Entra ID

The steps to configure your SCIM Azure Entra ID are as follows:

  1. Create an Azure Entra Enterprise Application

  2. Configure Provisioning

  3. Configure Mapping

  4. Provision Users

Create an Azure Entra Enterprise Application

To create an Azure Entra Enterprise Application:

  1. In the Azure Portal, navigate to Azure Entra.

  2. Select New Application.

  3. Select Create your own application.

  4. Enter a name for the application and select Integrate any other application you don’t find in the gallery (Non-gallery).

  5. Select Create to create the application.

Configure Provisioning

To configure the provisioning:

  1. Select the Provisioning menu in your Enterprise Application.

  2. Select New configuration.

The Tenant URL within the Provisioning section of your Enterprise Application refers to the target SCIM endpoint.

In Totalmobile, the SCIM endpoint follows a predictable pattern, using the Customer Tenant’s Hostname, for example:

Customer Name: TestCustomer

https://testcustomer.totalmobile-cloud.com/platform/api/scim/v1

  1. Enter the Tenant URL and Secret Token.

The Secret Token will be the Personal Access Token for your SCIM Service User and is provided by Totalmobile.

  1. Select Test connection to verify Azure Entra is able to communicate successfully with the provided URL and token.

  2. When the test connect is successful select the Save icon at the top of the page.

Configure Mapping

To configure the mapping:

  1. Select the Attribute mapping menu.

  2. Select Provision Microsoft Entra ID Users.

  3. Update the Attribute Mappings – as a minimum they must include the subset and must be mapped as follows:

    Attribute (Target Attribute)

    Microsoft Entra ID Attribute (Source Attribute)

    userName

    originalUserPrincipalName

    active

    Switch([IsSoftDeleted], , “False”, “True”, “True”, “False”)

    displayName

    displayName

    emails[type eq “work”].value

    mail

    name.givenName

    givenName

    name.familyName

    surname

    name.formatted

    Join(“ ”, [givenName], [surname])

    externalId

    objectId

    • The userName attribute must be mapped to originalUserPrincipalName (not userPrincipalName which may be a default).

    • If it has not already defaulted to it, the externalId attribute needs to be updated to map to the objectId.

    • Any associated Guest Access Package must be configured to collect these attributes e.g. a Guest account must capture ‘givenName’ and ‘surname’ at registration to ensure Guest Access functions as expected.

  4. Select Save.

Provision Users

To provision your users:

  1. In your Azure Entra ID Enterprise Application, select the Users and groups menu.

  2. Select the which Users are to be provisioned by the integration.

  3. Navigate back to the Overview menu.

  4. Select Start provisioning.

  5. The provisioning starts and runs in the background.