Skip to main content

Configuring SCIM provisioning with Azure

This article explains how to configure System for Cross-domain Identity Management (SCIM) provisioning with Azure for CisionOne.

System for Cross-domain Identity Management (SCIM) is a standard used to automate user provisioning between systems. SCIM allows an Identity Provider (IdP), such as Okta or Azure Active Directory (Azure AD), to automatically create, update, and deactivate user accounts in another platform without requiring manual administration

This article covers:

  • What System for Cross-domain Identity Management (SCIM) is and how it works

  • The differences between SCIM and Security Assertion Markup Language (SAML)

  • How to configure SCIM provisioning in Azure

  • How to configure SCIM attributes for teams and roles

SCIM vs SAML

System for Cross-domain Identity Management (SCIM) focuses on managing user accounts, while Security Assertion Markup Language (SAML) focuses on user authentication and sign-in. With SAML and Just-in-Time (JIT) provisioning, user accounts can be created automatically when a user signs in for the first time, without requiring SCIM.

SCIM is recommended when you need ongoing user lifecycle management, including updating user details, managing roles, and automatically removing access when users leave an organization. SAML with JIT provisioning is often suitable for simpler deployments that do not require full lifecycle management.

In many enterprise environments, SCIM and SAML are used together. SCIM provisions and synchronizes user accounts, while SAML provides a seamless sign-in experience.

Feature

SCIM

SAML

Purpose

Automates user provisioning and lifecycle management

Authenticates users and enables Single Sign-On (SSO)

User account creation

Creates users automatically through provisioning

Can create users through Just-in-Time (JIT) provisioning

User updates

Synchronizes user profile and role changes

Does not manage user updates

User deprovisioning

Automatically removes access when users leave

Does not manage deprovisioning

Authentication

No

Yes

Best suited for

Organizations that need user lifecycle management and synchronization

Organizations that need Single Sign-On (SSO) authentication

Common enterprise usage

Often used alongside SAML

Often used alongside SCIM

Configuring SCIM in Azure

  1. Log in to the Azure Portal and open your SAML application.

  2. Under Manage, select Provisioning.

  3. Under Get started, select Connect your application.

  4. You'll now see fields for Tenant URL and Secret Token.

    For Tenant URL, enter the following values: https://identity.cision.one/scim/v2.

  5. After signing in to the desktop application, navigate to Organizations and Integrations, and then select Manage Integration next to SAML Single Sign-On.

  6. Scroll to the bottom of the page, select Generate SCIM Token, and then select the + icon to copy the token.

  7. Return to the Azure portal and paste the token into the Secret Token field.

  8. Select Test connection to verify the configuration. If the connection is successful, a confirmation message is displayed in the upper-right corner of the page.

    Basic SCIM provisioning is now configured. To configure advanced attribute mappings, continue with the steps below.

  9. Select Attribute mapping (Preview), and then open Provision Microsoft Entra ID Users.

  10. Remove all default mappings (optional) except:

    · active

    · userName

    · emails

    · name.givenName

    · name.familyName

    To Configure custom role and team mappings, continue with the steps below.

  11. Select Show advanced options, and then select Edit attribute list for customappsso.

  12. Add the required custom attributes, ensuring the Reference is set to String for each attribute.

    urn:ietf:params:scim:schemas:extension:roles:2.0:User.monitoring_user_role

    urn:ietf:params:scim:schemas:extension:roles:2.0:User.social_user_role

    urn:ietf:params:scim:schemas:extension:roles:2.0:User.outreach_user_role

    urn:ietf:params:scim:schemas:extension:teams:2.0:User.primary_team

  13. Scroll to the top of the page, and then select Save.

  14. Return to the attribute mappings page and configure mappings for the custom attributes based on your Azure attribute configuration.

    Warning:

    Azure does not detect whether a user already exists in CisionOne. As a result, Azure may continue attempting to create the user during provisioning.

See How do I configure SAML Single Sign-On (SSO) with Azure for guidance on configuring SAML authentication and Identity Provider integrations.

Related Articles
Did this answer your question?