Skip to main content
Sign in

Azure User Provisioning (SCIM)

Brittany Rosenberg
  • Updated

Introduction

Microsoft Entra ID (formerly Azure AD) a identity provider that provides Single Sign-on (SSO) functionality. If your company has added SSO to their ModernLoop plan, you can manage login access to ModernLoop and maintain consistent security across your organization through your Microsoft Entra ID system.
Using SCIM allows you to proactively remove users from ModernLoop when you delete them in your user directory. For steps to set up SSO for Azure, see Azure Single Sign-on (SAML).

In this article

Enabling SCIM

  1. Navigate to http://portal.azure.com and log in as an administrator
  2. Navigate to the previously created Enterprise Application
  3. Access the Provisioning tab within the application settings
  4. Click on the Get Started button
  5. In the Provisioning Mode field, select Automatic
  6. Copy and paste the following Tenant URL: 
    https://mloop.prod.modernloop.io/org/scim/v2
  7. Copy and paste the secret token provided by your ModernLoop CSM in the Secret Token field
  8. Click Save

 

Manage ModernLoop Role Assignment using SCIM (using Microsoft Entra ID)

  1. Go to "App Registrations" and select the SAML application you created for ModernLoop.
  2. Navigate to the App Roles section.
  3. Create a new App Role named ML_ADMIN.
  4. Set the Allowed member types to "Users/Groups".
  5. Set the Value to "ADMIN".
  6. Add a description.
  7. Click Apply to save the app role.
  8. Repeat this process for additional ModernLoop roles, such as SCHEDULER and INTERVIEWER.


SCIM Attributes

The following properties passed by Microsoft Entra ID, if provided, will be mapped directly to ModernLoop SCIMUser object and stored in the ModernLoop Database. The minimum required attributes are familyName, givenName, emails, and modernloopRole.

  • userName: mapped directly to 'userName' property coming from SCIM
  • name: mapped directly to 'name' property coming from SCIM
    • familyName: The family name of the User, or last name in most Western languages (e.g., "Jensen" given the full name "Ms. Barbara Jane Jensen, III”).
    • givenName: The given name of the User, or first name in most Western languages (e.g., "Barbara" given the full name "Ms. Barbara Jane Jensen, III”).
  • emails: mapped directly to 'emails' multivalued property coming from SCIM
  • displayName: mapped directly to 'displayName' property coming from SCIM
  • locale: mapped directly to ‘locale' property coming from SCIM
  • active: mapped directly to ‘active' property coming from SCIM. Denotes if user is active or inactive (true/false)
  • modernloopRole: this is a custom property to map to ModernLoop roles - INTERVIEWER/SCHEDULER/ADMIN

Create a custom attribute

You must enable the creation of custom attributes for the SAML Application on Azure AD / Entra ID.

  1. Open the SAML Enterprise App.
  2. Navigate to the Provisioning section.
  3. Click Edit attribute mappings.
  4. Ensure the Tenant URL and Secret Token are working by entering the correct values and clicking Test Connection.
  5. Expand the Mappings section and select Provision Microsoft Entra ID Users.
  6. Scroll to the bottom of the page and select Show advanced options.
  7. Select Edit attribute list for custom SSO app. If these options are not available to you, open the Azure portal using the following URL: Azure AD portal with schema full enabled.
  8. Add a custom attribute called urn:ietf:params:scim:schemas:extension:modernloop:enterprise:2.0:User:modernloopRole and set the data type to string.
  9. Save the new configuration and click Save then Yes.

Map custom attributes to App roles using expression language

  1. Navigate to your Enterprise SAML Application > Provisioning
  2. Click on Edit Attribute Mapping
  3. Expand “Mappings” section and click on Provision Microsoft Entra ID Users
  4. Click Add New Mapping and Add a new mapping for ModernLoop Role Parameter
  5. Give Mapping Type as “Expression”
  6. Add the following Expression:
    • Switch(SingleAppRoleAssignment([appRoleAssignments]), "", "ML_ADMIN", "ADMIN", "ML_SCHEDULER", "SCHEDULER", "ML_INTERVIEWER", "INTERVIEWER")
  7. Default Value: INTERVIEWER
  8. Target: modernloopRole
  9. Click “Ok” to save the mapping

Set up security groups for member role setting

  1. Navigate to AD Groups.
  2. Create a New group called ModernLoop Admins.
  3. Click Create to save the security group.
  4. Open the SAML Enterprise App.
  5. Navigate to Users and groups.
  6. Click Add user/group.
  7. Set the Group name to the group ModernLoop Admin
  8. Set the Select a role to the app role ML_ADMIN.
  9. Click Assign.
  10. You can choose individual user also and assign Role to the user. Create additional groups with corresponding app roles if required.

Run SCIM Provisioning 

Run SCIM provisioning again so that these roles will be provisioned in ModernLoop

Related articles