Skip to main content
This guide walks you through setting up SCIM provisioning from Entra ID to Chamelio. SCIM provisioning keeps your Chamelio users and groups synchronized with your identity provider automatically.
SCIM provisioning is an additional step on top of SSO authentication. It is optional but recommended to keep users and groups continuously synchronized. Chamelio will provide you with a SCIM Endpoint URL and a Bearer Token to configure your IdP.
It is recommended to use two separate Entra ID applications — one for SSO and one for SCIM provisioning. This is an architectural best practice, though you may combine them if preferred.

​
Prerequisites

Before setting up SCIM, confirm the following:
  1. An SSO application has already been registered in Entra ID to handle user authentication.
  2. Your SSO application has Assignment Required set to Yes in Microsoft Entra ID > Enterprise applications > [Your Chamelio SSO App] > Manage > Properties.
  3. Users are assigned in the Users and Groups tab of the SSO application.
1

Create a Provisioning Application

Navigate to Enterprise applications and select New application.
  1. Select Create your own application.
  2. Enter a name, e.g. Chamelio-SCIM.
  3. Choose Integrate any other application you don’t find in the gallery (Non-gallery).
  4. Select Create.
Once created, navigate to Users and Groups in the left-hand navigation and assign the same users and groups as those assigned in your SSO application.
2

Configure SCIM

  1. Select Provisioning in the left-hand navigation, then choose Manage > Provisioning.
  2. Set Provisioning Mode to Automatic.
  3. Expand Admin Credentials.
  4. Paste the SCIM Endpoint URL Chamelio provided into the Tenant URL field.
The URL looks similar to:
https://chamelio.eu.auth0.com/scim/v2/connections/con_random?aadOptscim062020
  1. Paste the Bearer Token Chamelio provided into the Secret Token field.
  2. Click Test Connection to verify the credentials.
  3. Click Save.
3

Configure SCIM Attribute Mapping

SCIM mapping ensures the correct user attributes are passed from Entra ID to Chamelio.Navigate to Attribute mapping (Preview) and select Provision Microsoft Entra ID Users.You need to make two required changes:Edit emails[type eq "work"].valueFind the row with emails[type eq "work"].value mapped to mail and select Edit:
  • Set Match objects using this attribute to Yes
  • Set Matching precedence to 2
  • Click OK
Edit externalIdFind the row with externalId and select Edit:
  • Change Source attribute to objectId
  • Click OK
Click Save on the Attribute Mapping page.
4

Test Provisioning

Head back to your provisioning app and select Provision on demand.Search for a few test user accounts and provision them to verify the workflow is operating correctly before enabling automatic provisioning.
5

Enable Automatic Provisioning

Once you have confirmed provisioning works correctly with your test users:
  1. Navigate to Provisioning.
  2. Set Provisioning Status to On.
  3. Click Save.
You can monitor Provisioning logs to track successful provisioning of your users and groups.

​
Additional Recommendations

If you are using separate applications for SSO and SCIM, make sure only the SSO app is visible to your users. The SCIM app is a backend integration and should not appear in user portals.Navigate to the SCIM Enterprise App > Properties, set Visible to users? to No, and select Save.