mirror of
https://github.com/goauthentik/authentik
synced 2026-04-30 03:17:46 +02:00
6ed5cb5249
* website/integrations: rename "Create with Provider" to "New Application" The application list page now uses a split-button labeled "New Application" instead of the old "Create with Provider" dropdown. Update all 113 integration guides to match. * website/docs: update flow, stage, and policy button labels - "Create" → "New Flow", "New Stage", "New Policy" for trigger buttons - "Finish" → "Create Flow", "Create Stage", "Create Policy" for submit - "Create and bind stage" → "New Stage" / "Bind Existing Stage" - "Create" (binding submit) → "Create Stage Binding" * website/docs: update provider button labels - "Create" → "New Provider" for trigger buttons - "Create with Provider" → "New Application" in RAC docs - "Create" → "New Property Mapping", "New RAC Endpoint", "New Prompt" for related entity creation * website/docs: update directory button labels - "Create" → "New Source" for federation/social login pages - "Create" → "New Role", submit → "Create Role" - "Create" → "New Invitation" - Policy binding submit → "Create Policy Binding" * website/docs: update endpoint device and system management button labels - "Create" → "New Endpoint Connector", "New Enrollment Token", "New Device Access Group", "New Flow" - Submit → "Create Device Access Group" - "Create" → "New Notification Rule", "New Notification Transport" - Binding submit → "Create Policy Binding" * Reorganize policy documentation * website/docs: address policy docs review feedback * post-rebase * website/docs: Reorganize policy documentation -- Revisions (#21601) * apply suggestions * Fix escaped. * Fix whitespace. * Update button label. * Fix phrasing. * Fix phrasing. * Clean up stragglers. * Format. --------- Co-authored-by: Dominic R <dominic@sdko.org>
113 lines
6.1 KiB
Plaintext
113 lines
6.1 KiB
Plaintext
---
|
|
title: Entra ID SCIM user and group provisioning
|
|
sidebar_label: Entra ID SCIM
|
|
description: Provisioning users and groups from Entra ID to authentik via the SCIM protocol
|
|
toc_max_heading_level: 4
|
|
tags:
|
|
- source
|
|
- entra
|
|
- azure
|
|
- scim
|
|
---
|
|
|
|
This guide explains how to provision users and groups from Entra ID to authentik by configuring Entra ID as a SCIM source.
|
|
|
|
## Preparation
|
|
|
|
The following placeholders are used in this guide:
|
|
|
|
- `authentik.company` is the FQDN of the authentik installation.
|
|
|
|
## authentik configuration
|
|
|
|
To integrate authentik with Entra ID via SCIM, you need to create a SCIM source in authentik.
|
|
|
|
### Create SCIM source
|
|
|
|
1. Log in to authentik as an administrator and open the authentik Admin interface.
|
|
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
|
|
- **Select type**: select **SCIM Source**.
|
|
- **Create SCIM Source**: provide a name and a slug.
|
|
- All other configurations are optional.
|
|
3. Click **Finish**.
|
|
4. On the **Federation and Social login** page, click on the name of the newly created SCIM source.
|
|
5. Take note of the **SCIM Base URL**. This value will be required in the next section.
|
|
6. Under **Token**, click **Click to copy token** and securely store the value. This value will also be required in the next section.
|
|
|
|
:::warning Copying the token
|
|
If authentik has the required browser permissions, the token will be copied to your clipboard after you click the **Click to copy token** button. However, some browsers do not allow this. In those cases, a notification will appear in the bottom-right corner with the token, and you will need to copy it manually.
|
|
:::
|
|
|
|
:::warning Entra ID SCIM requirements
|
|
Microsoft requires that the authentik SCIM endpoint be accessible via TLS 1.2. If enforcing TLS 1.3, you may run into issues. For more information, refer to the [Microsoft SCIM endpoint documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups#security-requirements).
|
|
|
|
You can use the [Microsoft SCIM Validator](https://scimvalidator.microsoft.com/) to test connectivity to your authentik SCIM endpoint. Please note that the validator will always report approximately 13 errors. These can be safely ignored.
|
|
:::
|
|
|
|
## Entra ID configuration
|
|
|
|
### Create a custom enterprise application
|
|
|
|
1. Log in to [Entra ID](https://entra.microsoft.com) using a [global administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-administrator) account.
|
|
2. Navigate to **Enterprise apps**, click **Create your own application**, and configure the following fields:
|
|
- **Name**: provide a name for the application (e.g. `authentik-scim`).
|
|
- Select `Integrate any other application you don't find in the gallery (Non-gallery)`.
|
|
3. Click **Create**.
|
|
|
|
### Configure provisioning
|
|
|
|
4. Navigate to **Provisioning**, click **New Configuration**, and configure the following fields:
|
|
- **Tenant URL**: Set to the **SCIM Base URL** from authentik (e.g. `https://authentik.company/source/scim/entra-scim/v2`).
|
|
- **Secret Token**: Set to the **Token** from authentik.
|
|
5. Click **Test connection** to validate that Entra ID can communicate with authentik.
|
|
6. If the connection is successful, click **Create** and **Save**. If the connection fails, ensure that your authentik **SCIM Base URL** is accessible from the internet.
|
|
7. In the left sidebar, under **Manage**, click **Provisioning**.
|
|
|
|
There are three options for determining which users and groups are provisioned to authentik:
|
|
|
|
- Set Entra ID to sync all users and groups.
|
|
- Set Entra ID to sync all users and groups with scopes that limit which users and groups are synced.
|
|
- Set Entra ID to sync only assigned users and groups. Group assignment is only available to Microsoft Entra Suite, Microsoft Entra ID Governance, and Microsoft Entra ID P2 customers.
|
|
|
|
#### Sync all users and groups
|
|
|
|
1. On the **Provisioning** page, expand the **Settings** section, and set **Scope** to `Sync all users and groups`.
|
|
2. Toggle **Provisioning status** to `On`.
|
|
3. At the top of the page, click **Save**.
|
|
4. Track provisioning progress via the **Overview** page.
|
|
|
|
#### Sync all users and groups with scopes
|
|
|
|
1. On the **Provisioning** page, expand the **Settings** section, and set **Scope** to `Sync all users and groups`.
|
|
2. At the top of the page, click **Save**.
|
|
3. Expand the **Mappings** section and then click **Provision Microsoft Entra ID Users**.
|
|
4. Under **Source Object Scope**, click **All records**.
|
|
5. Click **Add new filter group**, design the filters that you want applied to synced users and click **Apply**.
|
|
6. Optionally, configure **Target object actions** and modify the **Attribute Mappings**.
|
|
7. At the top of the page, click **Save**.
|
|
8. On the **Provisioning** page, expand the **Mappings** section and then click **Provision Microsoft Entra ID Groups** and repeat steps 4-7.
|
|
9. Back on the **Provisioning** page, toggle **Provisioning status** to `On`.
|
|
10. At the top of the page, click **Save**.
|
|
11. Track provisioning progress via the **Overview** page.
|
|
|
|
#### Sync only assigned users and groups
|
|
|
|
1. On the **Provisioning** page, expand the **Settings** section, and set **Scope** to `Sync only assigned users and groups`.
|
|
2. At the top of the page, click **Save**.
|
|
3. Under **Manage**, click **Users and groups** and then click **Add user/group**.
|
|
4. Select the users and groups that you want synced to authentik.
|
|
5. Click **Assign**.
|
|
6. On the **Provisioning** page, toggle **Provisioning status** to `On`.
|
|
7. At the top of the page, click **Save**.
|
|
8. Track provisioning progress via the **Overview** page.
|
|
|
|
:::note Group assignment
|
|
Group assignment is only available for Microsoft Entra Suite, Microsoft Entra ID Governance and Microsoft Entra ID P2 subscribers.
|
|
:::
|
|
|
|
## Confirm provisioning in authentik
|
|
|
|
1. Log in to authentik as an administrator and open the authentik Admin interface.
|
|
2. Navigate to **Directory** > **Federation and Social login** and click on the name of the SCIM source.
|
|
3. Open the **Provisioned Users** and **Provisioned Groups** tabs to confirm whether the correct users and groups have been provisioned from Entra ID.
|