Skip to content

Provision Microsoft Entra ID users with SCIM#

SCIM keeps your Microsoft Entra ID directory and the BSR in sync: Entra users are provisioned as BSR users automatically. SAML sign-in is the prerequisite and is configured separately on the Microsoft side; this page picks up after the BSR enterprise application exists in Entra.

The steps below must be carried out by users with administrative privileges in your Microsoft Entra ID tenant.

Before you start#

  • Register the BSR as an enterprise application in Entra ID with SAML sign-on configured. Buf doesn’t ship a dedicated walkthrough for this; follow Microsoft’s SAML SSO documentation.
  • Create a SCIM token in the BSR; see Create a SCIM token.
  • Know your private BSR instance’s domain name (for example, your-bsr-instance.example.com).
  • Have administrative access to your Entra ID tenant.

Configure SCIM provisioning in Entra ID#

  1. Sign in to your Azure portal.
  2. Navigate to your BSR application under Enterprise applications in your Entra ID tenant.
  3. Click Provisioning in the side bar, then click Configure Provisioning.
  4. Under Provisioning Mode, select Automatic.
  5. Under Admin Credentials, enter the following information:
    • Tenant URL: https://your-bsr-instance.example.com/scim/v2
    • Secret Token: enter the SCIM token created above
  6. Click Save.

Configure attribute mappings#

The five mappings below are the supported set for the BSR. Leaving Entra’s defaults in place tends to produce mismatched userName or email values during provisioning, so delete every other mapping.

  1. Navigate to your BSR application under Enterprise applications in your Entra ID tenant.
  2. On the left sidebar, click Provisioning.
  3. Under Mappings, click Provision Microsoft Entra ID Users.

  4. Ensure that the following attribute mappings are set, and delete all other attribute mappings.

    Microsoft Entra ID attribute Application attribute
    userPrincipalName userName
    Switch([IsSoftDeleted], , "False", "True", "True", "False") active
    mail emails[type eq "work"].value
    givenName name.givenName
    surname name.familyName

  5. Click Save.

Start provisioning#

In the Overview tab in the Provisioning app, click Start Provisioning. Entra provisions users on a fixed interval; for an immediate run, navigate to Provision on demand.

If the Entra application was assigned to users before SCIM was enabled, Entra tries to match each one against an existing BSR user, which should succeed without error. If matching fails, consult the Provisioning Logs tab in the Provisioning app.

If provisioning fails for a user, see How do I resolve a failed user provision?. For unresolved issues, contact Support or your Buf representative.

Group membership#

SCIM can sync groups from Entra, but BSR organization membership is driven by automated organization membership provisioning rather than direct SCIM group push. Configure the IdP-to-organization group mapping on the BSR side once users are provisioned.

Troubleshooting#