> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cedarai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure SCIM

> Sync users and groups from Microsoft Entra ID (Azure AD) using SCIM.

# Sync users and groups from Microsoft Entra ID using SCIM

Cedar.AI supports System for Cross-domain Identity Management (SCIM) to automatically provision and de-provision users and groups from Microsoft Entra ID (formerly Azure Active Directory). This allows you to manage user access centrally within your identity provider.

<Note>
  <b>SCIM requires enrollment in Admin v2.</b> You'll create a SCIM connection in the Cedar.AI Admin Portal, then use the generated client credentials in Azure provisioning.
</Note>

## Prerequisites

<CardGroup cols={2}>
  <Card title="Cedar.AI Admin Access" icon="shield-check">
    You must be able to log in to the [Cedar.AI Admin Portal](https://admin.cedarai.com) and [create a SCIM mapping](/user-docs/admin/scim) to get client credentials.
  </Card>

  <Card title="Azure AD Admin Access" icon="microsoft">
    You need permissions to create Enterprise Applications in your Microsoft Entra ID tenant.
  </Card>
</CardGroup>

<Tip>
  Before starting, create a SCIM mapping in the [Admin Portal](/user-docs/admin/scim) to get your **Client ID** and **Client Secret**.
</Tip>

## Configuration Steps

<Steps>
  <Step title="Create a SCIM connection in the Cedar.AI Admin Portal (Admin v2)">
    1. Obtain your Microsoft Entra ID (Azure AD) <b>Tenant ID</b>.
    2. In the Cedar.AI Admin Portal, go to <b>Advanced</b> → <b>SCIM</b>.
    3. Click <b>New mapping</b>.
    4. Enter the Entra <b>Tenant ID</b> and associate it with an <b>Organization</b> or a <b>Carrier</b>.
    5. Click <b>Create</b>.
    6. From the newly created SCIM connection, copy the <b>Client ID</b> and <b>Client Secret</b> (you'll use these in Azure provisioning).
  </Step>

  <Step title="Create an Enterprise Application in Azure">
    1. Log in to the [Microsoft Entra Admin Center](https://entra.microsoft.com/).
    2. Navigate to <b>Identity</b> > <b>Applications</b> > <b>Enterprise applications</b>.
    3. Click <b>New application</b>.
    4. Click <b>Create your own application</b>.
    5. Enter a name for your application (e.g., "Cedar.AI SCIM").
    6. Select <b>Integrate any other application you don't find in the gallery (Non-gallery)</b>.
    7. Click <b>Create</b>.
  </Step>

  <Step title="Configure provisioning">
    1. In your newly created application, go to the <b>Provisioning</b> blade in the left menu.
    2. Click <b>Get started</b>.
    3. Set the <b>Provisioning Mode</b> to <b>Automatic</b>.
  </Step>

  <Step title="Enter SCIM endpoints and credentials">
    Cedar.AI uses the <b>OAuth 2.0 Client Credentials</b> grant flow for SCIM authentication.

    Expand the <b>Admin Credentials</b> section and enter the values below.

    <Tabs>
      <Tab title="SCIM testing">
        | Field          | Value                                                                                                                         |
        | -------------- | ----------------------------------------------------------------------------------------------------------------------------- |
        | Tenant URL     | `https://api-k.arms-staging.cedarai.com/scim/<your_tenant_id>/`                                                               |
        | Token Endpoint | <code>[https://auth.accounts-staging.cedarai.com/oauth2/token](https://auth.accounts-staging.cedarai.com/oauth2/token)</code> |
      </Tab>

      <Tab title="SCIM production">
        | Field          | Value                                                                                                         |
        | -------------- | ------------------------------------------------------------------------------------------------------------- |
        | Tenant URL     | `https://api-k.arms.cedarai.com/scim/<your_tenant_id>/`                                                       |
        | Token Endpoint | <code>[https://auth.accounts.cedarai.com/oauth2/token](https://auth.accounts.cedarai.com/oauth2/token)</code> |
      </Tab>
    </Tabs>

    Replace `<your_tenant_id>` with your specific Azure Tenant ID.

    <Note>
      Use the same environment for your Tenant URL and Token Endpoint, and use the Client ID/Secret you generated in the Admin Portal SCIM connection.
    </Note>

    <b>Authentication Method</b>: Ensure Azure provisioning is set to use <b>OAuth 2.0 Client Credentials Grant</b> (if available in your connector options) or follow the workflow prompted by Azure.

    You will need:

    * <b>Client Identifier</b>: (from the Admin Portal SCIM connection)
    * <b>Client Secret</b>: (from the Admin Portal SCIM connection)

    <Note>
      If the standard Azure "Non-gallery" SCIM connector only requests a "Secret Token", you may need to generate a long-lived bearer token using the client credentials or contact Cedar.AI support for the appropriate configuration pattern for your tenant.
    </Note>
  </Step>

  <Step title="Test connection and save">
    1. Click <b>Test Connection</b> to ensure Azure can communicate with the Cedar.AI SCIM endpoint.
    2. Once the test passes, click <b>Save</b>.
  </Step>

  <Step title="Assign users and groups">
    Azure AD only provisions users and groups that are explicitly assigned to the application.

    1. Go to the <b>Users and groups</b> blade for your application.
    2. Click <b>Add user/group</b>.
    3. Select the users and groups you want to sync to Cedar.AI.
       * <b>Groups</b>: Assigning a group provisions the group itself and its direct members. Nested groups are not supported by the standard SCIM connector (flattening may be required).
       * <b>Users</b>: Users must be assigned directly or through a group to be provisioned.
    4. Click <b>Assign</b>.
  </Step>

  <Step title="Start provisioning">
    1. Under <b>Mappings</b>, review the user and group attribute mappings to ensure they align with your requirements.
    2. Go back to the <b>Provisioning</b> overview.
    3. Set the <b>Provisioning Status</b> to <b>On</b>.
    4. Click <b>Save</b>.

    <Note>
      Azure AD will start an initial synchronization cycle, followed by periodic incremental cycles (typically every 40 minutes). You can monitor progress in the <b>Provisioning logs</b>.
    </Note>
  </Step>
</Steps>

## Important Considerations

<AccordionGroup>
  <Accordion title="Scope" icon="bullseye" defaultOpen>
    By default, Azure AD provisions only assigned users and groups. Ensure "Sync only assigned users and groups" is selected in the Provisioning settings unless you intend to sync your entire directory.
  </Accordion>

  <Accordion title="De-provisioning" icon="user-minus">
    When a user is unassigned from the application or disabled in Azure AD, a SCIM disable (soft delete) request is sent to Cedar.AI. The user will lose access immediately.
  </Accordion>

  <Accordion title="Group Updates" icon="users">
    Renaming a group in Azure AD will update the group name in Cedar.AI. Removing a user from a group in Azure AD will remove them from the corresponding group in Cedar.AI.
  </Accordion>
</AccordionGroup>

## Related Pages

<CardGroup cols={2}>
  <Card title="Admin Portal: SCIM" href="/user-docs/admin/scim" icon="gear">
    Create and manage SCIM mappings
  </Card>

  <Card title="SCIM Overview" href="/user-docs/sso/scim/overview" icon="book">
    Technical protocol details
  </Card>

  <Card title="Users" href="/user-docs/admin/users" icon="user">
    View provisioned users
  </Card>

  <Card title="User Groups" href="/user-docs/admin/user-groups" icon="users">
    Manage provisioned groups
  </Card>
</CardGroup>