> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chamelio.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Entra ID – SCIM Provisioning Setup

> Step-by-step guide to configure SCIM user and group provisioning from Microsoft Entra ID to Chamelio

This guide walks you through setting up SCIM provisioning from Entra ID to Chamelio. SCIM provisioning keeps your Chamelio users and groups synchronized with your identity provider automatically.

<Info>
  SCIM provisioning is an additional step on top of SSO authentication. It is optional but recommended to keep users and groups continuously synchronized. Chamelio will provide you with a **SCIM Endpoint URL** and a **Bearer Token** to configure your IdP.
</Info>

It is recommended to use two separate Entra ID applications — one for SSO and one for SCIM provisioning. This is an architectural best practice, though you may combine them if preferred.

## Prerequisites

Before setting up SCIM, confirm the following:

1. An SSO application has already been registered in Entra ID to handle user authentication.
2. Your SSO application has **Assignment Required** set to **Yes** in **Microsoft Entra ID > Enterprise applications > \[Your Chamelio SSO App] > Manage > Properties**.
3. Users are assigned in the **Users and Groups** tab of the SSO application.

<Steps>
  <Step title="Create a Provisioning Application">
    Navigate to **Enterprise applications** and select **New application**.

    1. Select **Create your own application**.
    2. Enter a name, e.g. `Chamelio-SCIM`.
    3. Choose **Integrate any other application you don't find in the gallery (Non-gallery)**.
    4. Select **Create**.

    Once created, navigate to **Users and Groups** in the left-hand navigation and assign the **same users and groups** as those assigned in your SSO application.
  </Step>

  <Step title="Configure SCIM">
    1. Select **Provisioning** in the left-hand navigation, then choose **Manage > Provisioning**.
    2. Set **Provisioning Mode** to **Automatic**.
    3. Expand **Admin Credentials**.
    4. Paste the **SCIM Endpoint URL** Chamelio provided into the **Tenant URL** field.

    The URL looks similar to:

    ```
    https://chamelio.eu.auth0.com/scim/v2/connections/con_random?aadOptscim062020
    ```

    5. Paste the **Bearer Token** Chamelio provided into the **Secret Token** field.
    6. Click **Test Connection** to verify the credentials.
    7. Click **Save**.
  </Step>

  <Step title="Configure SCIM Attribute Mapping">
    SCIM mapping ensures the correct user attributes are passed from Entra ID to Chamelio.

    Navigate to **Attribute mapping (Preview)** and select **Provision Microsoft Entra ID Users**.

    You need to make two required changes:

    **Edit `emails[type eq "work"].value`**

    Find the row with `emails[type eq "work"].value` mapped to `mail` and select **Edit**:

    * Set **Match objects using this attribute** to **Yes**
    * Set **Matching precedence** to **2**
    * Click **OK**

    **Edit `externalId`**

    Find the row with `externalId` and select **Edit**:

    * Change **Source attribute** to `objectId`
    * Click **OK**

    Click **Save** on the Attribute Mapping page.
  </Step>

  <Step title="Test Provisioning">
    Head back to your provisioning app and select **Provision on demand**.

    Search for a few test user accounts and provision them to verify the workflow is operating correctly before enabling automatic provisioning.
  </Step>

  <Step title="Enable Automatic Provisioning">
    Once you have confirmed provisioning works correctly with your test users:

    1. Navigate to **Provisioning**.
    2. Set **Provisioning Status** to **On**.
    3. Click **Save**.

    You can monitor **Provisioning logs** to track successful provisioning of your users and groups.
  </Step>
</Steps>

## Additional Recommendations

<Accordion title="Hide the SCIM app from users">
  If you are using separate applications for SSO and SCIM, make sure only the SSO app is visible to your users. The SCIM app is a backend integration and should not appear in user portals.

  Navigate to the SCIM Enterprise App > **Properties**, set **Visible to users?** to **No**, and select **Save**.
</Accordion>