Skip to main content

​
Sync users and groups from Microsoft Entra ID using SCIM

Cedar.AI supports System for Cross-domain Identity Management (SCIM) to automatically provision and de-provision users and groups from Microsoft Entra ID (formerly Azure Active Directory). This allows you to manage user access centrally within your identity provider.
SCIM requires enrollment in Admin v2. You’ll create a SCIM connection in the Cedar.AI Admin Portal, then use the generated client credentials in Azure provisioning.

​
Prerequisites

Cedar.AI Admin Access

You must be able to log in to the Cedar.AI Admin Portal and create a SCIM mapping to get client credentials.

Azure AD Admin Access

You need permissions to create Enterprise Applications in your Microsoft Entra ID tenant.
Before starting, create a SCIM mapping in the Admin Portal to get your Client ID and Client Secret.

​
Configuration Steps

1

Create a SCIM connection in the Cedar.AI Admin Portal (Admin v2)

  1. Obtain your Microsoft Entra ID (Azure AD) Tenant ID.
  2. In the Cedar.AI Admin Portal, go to Advanced → SCIM.
  3. Click New mapping.
  4. Enter the Entra Tenant ID and associate it with an Organization or a Carrier.
  5. Click Create.
  6. From the newly created SCIM connection, copy the Client ID and Client Secret (you’ll use these in Azure provisioning).
2

Create an Enterprise Application in Azure

  1. Log in to the Microsoft Entra Admin Center.
  2. Navigate to Identity > Applications > Enterprise applications.
  3. Click New application.
  4. Click Create your own application.
  5. Enter a name for your application (e.g., “Cedar.AI SCIM”).
  6. Select Integrate any other application you don’t find in the gallery (Non-gallery).
  7. Click Create.
3

Configure provisioning

  1. In your newly created application, go to the Provisioning blade in the left menu.
  2. Click Get started.
  3. Set the Provisioning Mode to Automatic.
4

Enter SCIM endpoints and credentials

Cedar.AI uses the OAuth 2.0 Client Credentials grant flow for SCIM authentication.Expand the Admin Credentials section and enter the values below.
FieldValue
Tenant URLhttps://api-k.arms-staging.cedarai.com/scim/<your_tenant_id>/
Token Endpointhttps://auth.accounts-staging.cedarai.com/oauth2/token
Replace <your_tenant_id> with your specific Azure Tenant ID.
Use the same environment for your Tenant URL and Token Endpoint, and use the Client ID/Secret you generated in the Admin Portal SCIM connection.
Authentication Method: Ensure Azure provisioning is set to use OAuth 2.0 Client Credentials Grant (if available in your connector options) or follow the workflow prompted by Azure.You will need:
  • Client Identifier: (from the Admin Portal SCIM connection)
  • Client Secret: (from the Admin Portal SCIM connection)
If the standard Azure “Non-gallery” SCIM connector only requests a “Secret Token”, you may need to generate a long-lived bearer token using the client credentials or contact Cedar.AI support for the appropriate configuration pattern for your tenant.
5

Test connection and save

  1. Click Test Connection to ensure Azure can communicate with the Cedar.AI SCIM endpoint.
  2. Once the test passes, click Save.
6

Assign users and groups

Azure AD only provisions users and groups that are explicitly assigned to the application.
  1. Go to the Users and groups blade for your application.
  2. Click Add user/group.
  3. Select the users and groups you want to sync to Cedar.AI.
    • Groups: Assigning a group provisions the group itself and its direct members. Nested groups are not supported by the standard SCIM connector (flattening may be required).
    • Users: Users must be assigned directly or through a group to be provisioned.
  4. Click Assign.
7

Start provisioning

  1. Under Mappings, review the user and group attribute mappings to ensure they align with your requirements.
  2. Go back to the Provisioning overview.
  3. Set the Provisioning Status to On.
  4. Click Save.
Azure AD will start an initial synchronization cycle, followed by periodic incremental cycles (typically every 40 minutes). You can monitor progress in the Provisioning logs.

​
Important Considerations

Scope

By default, Azure AD provisions only assigned users and groups. Ensure “Sync only assigned users and groups” is selected in the Provisioning settings unless you intend to sync your entire directory.
When a user is unassigned from the application or disabled in Azure AD, a SCIM disable (soft delete) request is sent to Cedar.AI. The user will lose access immediately.
Renaming a group in Azure AD will update the group name in Cedar.AI. Removing a user from a group in Azure AD will remove them from the corresponding group in Cedar.AI.

Admin Portal: SCIM

Create and manage SCIM mappings

SCIM Overview

Technical protocol details

Users

View provisioned users

User Groups

Manage provisioned groups