Requirements
Be familiar with the General setup, have SCIM enabled for an organization, and have access to an Entra instance.
SCIM provisioning: General Setup
Resources
Application configuration
- In Entra admin dashboard, create a new application (or use an existing one):
Click “Create at the bottom of the page
2. Go to provisioning and connect your application
3. Enter the following information:
- Tenant URL: <Env IdP URL>/api/scim/v2/
- Secret token: use the token from the organization settings page
Click on Test Connection before saving to make sure that everything works as expected
4. Turn on provisioning and save
User sync
This guide assumes that you already have users in your directory. They can be created in Entra ID > Users.
- Assign a user to the application
2. Microsoft Entra will provision assigned users at a fixed interval (40 minutes by default). To bypass this and test our provisioning, we can either restart provisioning which should resync everything within a minute, or use the “Provisioning on demand” feature:
3. The user should have been created in the CodeSignal organization dashboard with the organization default role (either as a member or an invitation, depending on the set-up.
That’s it! User sync is set up. Other changes such as name updates or removal should be synced as well.
Team sync
Groups and assignments can be managed in Entra ID > Groups. For testing purposes, create a couple from there prior to following this guide.
Note that we do not support assigning roles to groups.
- Make sure that team management through SCIM is enabled.
- Assign a group to the application
3. Go to Provisioning > Provision on demand, and provision for the selected group and its users:
4. Go to the organization user management dashboard and see that the group has been created with its associated users:
That’s it! Team management through SCIM is set up.
To test de-provisioning, make sure to call the “On demand provisioning” on users as well as the group, otherwise users parts of the group won’t be removed from the organization.
Role sync
- Make sure that role management through SCIM is enabled.
- Create AppRoles in App registrations
- Display name: any string (e.g. Role)
- Value: must match CodeSignal role’s key (e.g. client.manager)
- Description: any string
- Check the checkbox to enable the role
Role keys for custom roles can be retrieved from the CodeSignal dashboard URL
3. Go to your application mapping in Enterprise apps > Provisioning > Attribute mapping > Users
4. At the bottom of the page, click on “Add New Mapping”
- Mapping type: Expression
-
Expression — either:
A. Magic formula that will extract the AppRole value instead of the name: Item(Split(Item(Split(AppRoleAssignmentsComplex([appRoleAssignments]),"\"value\":\""), 2), "\""), 1)
B. Simpler expression that requires the Display name in the previous step to match CodeSignal role key:
SingleAppRoleAssignment([appRoleAssignments])
- Default value: leave blank, we use a default role in the organization settings page
- Target attribute: select roles[primary eq "True"].value
Leave other settings with default values.
5. Assign a new user with the AppRole to the application.
6. Sync the newly assigned user through On demand provisioning and check that the user role has been set: