Configuring SCIM in SSW and Azure AD

Introduction to SCIM

System for Cross-domain Identity Management (SCIM) is an open standard designed to manage user identities in cloud-based applications and services. SCIM simplifies user provisioning and ensures seamless integration between identity providers (like Azure AD) and service providers (like SSW).

Step-by-Step Guide to Configuring SCIM in SSW

1. Enable SCIM in SSW

Step 1.1: Navigate to Settings → Identity Providers.

Step 1.2: Create or edit the SAML configuration.

Step 1.3: Check the SCIM option to enable this function.

Step 1.4: When you enable SCIM, the system will display the Basic URL and API Token, which are necessary for the subsequent steps.

2. Configure SCIM in Azure Enterprise Application

Step 2.1: In Azure, navigate to the created SAML application.

Step 2.2: Go to Provisioning → Provisioning Mode and select Automatic.

Step 2.3: Enter the SSW configuration details obtained in Step 1.4 into the Azure provisioning settings.

Step 2.4: After entering the details, run a test to ensure the configuration is correct.

Step 2.5: Save the configuration after the test is successful.

3. Start Provisioning

Step 3.1: Go to Overview → Start Provisioning to initiate the process.

Step 3.2: Once the provisioning cycle completes, verify in SSW that all users have been created correctly.

SCIM Limitations on Azure

Sync Frequency: After the initial SCIM sync, Azure will automatically sync with the Service Provider (SP) every 40 minutes. Only updated users will be synced.

User Deletion: If a user is deleted on the SP side after the initial sync, the user will not be recreated unless the user is edited on the Azure side. In such cases, manually run Provision on Demand to recreate the user.

Group Sync: Only assigned groups in Azure can be synced to the SP endpoint via SCIM.