Azure/Entra ID - SCIM Configuration

Azure/Entra ID - SCIM Configuration

Idea
This application has been formally tested by Kelvin Zero Inc.
Quote
This documentation provides a step-by-step guide to setting up SCIM provisioning for Microsoft 365 (M365) using Multi-Pass. SCIM enables automated provisioning and deprovisioning of users, improving both security and administrative efficiency.
Warning
To set up SCIM with Multi-Pass and Microsoft 365, ensure you meet the following requirements:
- Global Admin permissions in Microsoft 365
- MPAS Admin rights
Important: Custom elements in URLs (like realm names) are case sensitive. Make sure to match the exact casing from your environment
Important: Ensure you always configure a backup admin account on the tenant that uses the .onmicrosoft domain only to prevent accidental lockouts




Azure/Entra ID - SCIM Configuration





Step 1 - Configure Multi-Pass to Support SCIM Provisioning (SP)

  1. Open Multi-Pass Dashboard
  2. Select the correct tenant
  3. Select Integrations and then SCIM
  4. Select SCIM Endpoint

  1. Set the Profile to Azure
  2. Insert your Azure Tenant ID
  3. Toggle on the Enable switch
  4. Select Update
  1. Select Advanced Console
  1. Select Clients and search for "scim-endpoint"
  2. Go to the Client Scopes tab
  3. Click on scim-endpoint-dedicated
  4. Select Add Mapper by Configuration
  5. Select User Attribute
  6. Create 7 User Attributes based on the tables below
    1. status
    2. loginName
    3. firstName
    4. manager
    5. lastName
    6. tag
    7. email
Status
FieldValue
Mapper TypeUser Attribute
Namestatus
User AttributeisSoftDeleted
Token Claimactive
  Claim JSON Type
 Boolean
  Add to ID token
 ON
  Add to access token
 ON
  Add to userinfo
 ON
  Add to token introspection
 ON

LoginName
FieldValue
Mapper TypeUser Attribute
NameloginName
User AttributeuserPrincipalName
Token ClaimuserName
  Claim JSON Type
 String
  Add to ID token
 ON
  Add to access token
 ON
  Add to userinfo
 ON
  Add to token introspection
 ON

FirstName
FieldValue
Mapper TypeUser Attribute
NamefirstName
User AttributegivenName
Token Claimname.givenName
  Claim JSON Type
 String
  Add to ID token
 ON
  Add to access token
 ON
  Add to userinfo
 ON
  Add to token introspection
 ON

Manager
FieldValue
Mapper TypeUser Attribute
Namemanager
User Attributemanager
Token Claimmanager
  Claim JSON Type
 String
  Add to ID token
 ON
  Add to access token
 ON
  Add to userinfo
 ON
  Add to token introspection
 ON

LastName
FieldValue
Mapper TypeUser Attribute
NamelastName
User AttributesurName
Token Claimname.familyName
  Claim JSON Type
 String
  Add to ID token
 ON
  Add to access token
 ON
  Add to userinfo
 ON
  Add to token introspection
 ON

Tag
FieldValue
Mapper TypeUser Attribute
Nametag
User AttributeextensionAttribute1
Token Claimurn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:tag
  Claim JSON Type
 String
  Add to ID token
 ON
  Add to access token
 ON
  Add to userinfo
 ON
  Add to token introspection
 ON

Email
FieldValue
Mapper TypeUser Attribute
Nameemail
User Attributeemail
Token Claimemail
  Claim JSON Type
 String
  Add to ID token
 ON
  Add to access token
 ON
  Add to userinfo
 ON
  Add to token introspection
 ON

Step 2 - Create the Multi-Pass SCIM Application in Entra ID

  1. Log into Entra ID as an Administrator
  2. Browse to Enterprise Apps
  3. Select New Application
  4. Select Create your own application
  5. In the Name field, write Multi-Pass SCIM
  6. Select Integrate any other application you don’t find in the gallery (Non-gallery)
  7. Click Create

  1. The new application will load, select Users and Groups under Manage
  2. Add the Users or Groups you want to be configured with SCIM to Multi-Pass


Step 3 - Enabling and Testing SCIM Provisioning (IdP)

  1. Create a new user in Entra ID
  2. Browse to Enterprise Apps and locate the Multi-Pass SCIM application
  3. Under Manage, select Users and Groups.
  4. Assign the User to the Multi-Pass SCIM application
  5. Select Provisioning under Manage
  6. Under Provisioning Mode, select Automatic
  7. Under Admin Credentials, select Bearer Authentication
  8. Under Tenant URL, enter:
    1. https://ca.auth.kzero.com/realms/<TENANT_NAME>/scim/v2
  9. Select Test Connection
  10. Set Provisioning Status to ON
  11. Select Save

  • Browse to Overview (Preview)
  • Select Start provisioning if it has not started
  • Once it has started, return to Multi-Pass to confirm the user synced to the platform

    • Related Articles

    • Azure EAM - MPAS integration

      This documentation has been tested and approved by Kelvin Zero's team This document will outline the steps required to enable MPAS as an external authentication method in Microsoft Entra ID. To set up Multi-Pass, ensure you meet the following ...

    • Entra IDP integration

      Entra IDP integration This guide walks you through the steps to configure Azure Active Directory (Azure AD) as an Identity Provider (IdP) in the Kelvin Zero Multi-Pass Authentication Service (MPAS) using OpenID Connect. Prerequisites : - An Azure ...

    • D2L Brightspace - SSO Integration

      This application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk. This documentation provides a step-by-step guide to ...

    • Mulesoft - SSO Integration

      This application has been formally tested by Kelvin Zero Inc. This documentation provides a step-by-step guide to setting up Single Sign-On (SSO) for Mulesoft using Multi-Pass. SSO simplifies user authentication by allowing access to multiple ...

    • Acronis - SSO configuration

      Please note that this application has not been formally tested by Kelvin Zero Inc. It is provided solely as a reference guide. If you encounter any issues, kindly submit a ticket directly through the support desk. This documentation provides a ...