# Setting up Microsoft Entra SCIM

> Set up SCIM provisioning between Microsoft Entra and Persona: create a SCIM API key, connect the app, and map Entra groups to Persona roles.

Source: https://help.withpersona.com/articles/5RdYNFC3JpaXjgSutibXxl/
Section: Admin > Single sign-on (SSO) and Authentication > Using SSO and SCIM

## Overview

SCIM (System for Cross-domain Identity Management) is a standard for managing user and group provisioning in an Identity Provider (IdP), ensuring that updates to users and groups are reflected in any relying parties, such as Persona. Persona supports some SCIM functionality for customers using Entra as their IdP.

<b>Groups</b> in SCIM refer to <b>roles</b> in Persona. To implement SCIM, SSO will need to be
established.

### High-Level Steps to Enable SCIM Provisioning for a Persona Organization:

1.  Enable SCIM Provisioning
2.  Configure the SCIM integration
3.  Import users and groups into Persona
4.  Provision Users & Groups

## Prerequisite

SCIM is a highly sensitive feature, and API keys do not have SCIM permissions enabled by default. Persona recommends creating a dedicated API key (distinct from the one used for general calls to persona-web) for SCIM purposes. SCIM is available on production environments only, so a sandbox API key cannot authenticate SCIM requests.

### Creating an API Key

1.  Navigate to your Persona **Dashboard > API**.
2.  Create a new API key via **\+ Create API key**.
3.  Once you’ve provided a name and description of the new API Key, you’ll be dropped in the configuration of the newly created API key.
4.  Select the **Permissions** tab, expand the **API** drop-down, and check the checkbox for **Use API Key for SCIM**. Click on **Save**, and keep this in mind as we’ll need the API key for SCIM integration.

⚠️

API keys do not have the SCIM permission set up by default. If you’re seeing <code>ApplicationController::Unauthorized</code> when setting up SCIM, double check that the **Use API Key for SCIM** permission is enabled on a production API key.

## Enabling SCIM Provisioning

1.  Log in to your Microsoft Entra admin center and navigate to the application you have previously set up for the Persona SAML integration. For the purpose of this guide, we’ll refer to it as the Persona Application.
2.  Once you’ve selected the Persona Application, go to the **Provisioning** tab.

## Configuring the SCIM Integration

1.  Click on **Connect your application**
2.  For **Tenant URL**, enter `https://withpersona.com/scim/v2`.
3.  For **Secret Token**, fetch the `Persona SCIM API Key` created in the prerequisite step and paste in the value.
4.  Click **Test Connection** to ensure the connection is successful.
5.  Confirm that you see a successful ✅ Provisioning test connection. You can close this step now.

## Provisioning Users & Groups

Once the SCIM configuration is connected, we need to map the Users and groups. High-level steps are:

- Create Persona Roles in Entra Groups
- Remap Application with Groups

### Create Persona Roles in Entra Groups

1.  Navigate to **Groups > Overview**.
2.  Click on **New group**.
3.  Navigate to **Users and groups** section.
4.  Click on **Add user/group**, and create one Group in Entra per Persona Role, named exactly as the role is named in Persona.
5.  Once the Groups are created, add the desired Users into the respective Entra Groups.

☝️

Make sure that each Entra Group name matches the Persona Role name exactly.

### Remap Application with Groups instead of Users

1.  Navigate back to the application in the _Enabling SCIM Provisioning_ section.
2.  Click on **Assign Users and Groups** tile, or navigate to the **Users and Groups** Section
3.  Click on **Add user/group,** and add the Groups that match the Persona roles
4.  Go back to **Overview (Preview),** click on **▷ Start Provisioning**
5.  Wait until provision is finished and you are done!

💡

You can always check the Provisioning logs for results.

## Plans Explained

### SCIM with Microsoft Entra by plan

|                           | Startup Program | Essential Plan | Growth Plan   | Enterprise Plan |
| ------------------------- | --------------- | -------------- | ------------- | --------------- |
| SCIM with Microsoft Entra | Not Available   | Not Available  | Not Available | Available       |

[Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).