Overview
SCIM (System for Cross-domain Identity Management) is a standard to manage user and group provisioning in an Identity Provider (IdP). It makes sure that all relying parties, for example Persona, get the updates to users and groups. Persona supports some SCIM functions for customers that use Entra as their IdP.
Groups in SCIM are roles in Persona. To implement SCIM, you must first set up SSO.
High-Level Steps to Enable SCIM Provisioning for a Persona Organization:
- Enable SCIM Provisioning
- Configure the SCIM integration
- Import users and groups into Persona
- Provision Users & Groups
Prerequisite
SCIM is a very sensitive feature. By default, API keys do not have SCIM permissions enabled. Persona recommends a dedicated API key for SCIM. Do not use the API key for general calls to persona-web. SCIM is available only in production environments. Thus, a sandbox API key cannot authenticate SCIM requests.
Creating an API Key
- Go to your Persona Dashboard > API.
- Click + Create API key to create a new API key.
- After you enter a name and description for the new API Key, the configuration of the new API key opens.
- Select the Permissions tab, expand the API drop-down, and check the checkbox for Use API Key for SCIM. Click Save. Remember this API key, because you need it for the SCIM integration.
By default, API keys do not have the SCIM permission. If you see ApplicationController::Unauthorized when you set up SCIM, make sure that the Use API Key for SCIM permission is enabled on a production API key.
Enabling SCIM Provisioning
- Log in to your Microsoft Entra admin center. Go to the application that you set up before for the Persona SAML integration. In this guide, the name of this application is the Persona Application.
- After you select the Persona Application, go to the Provisioning tab.
Configuring the SCIM Integration
- Click Connect your application.
- For Tenant URL, enter
https://withpersona.com/scim/v2. - For Secret Token, get the
Persona SCIM API Keythat you created in the prerequisite step. Paste the value. - Click Test Connection to make sure that the connection is successful.
- Make sure that you see a successful ✅ Provisioning test connection. You can now close this step.
Provisioning Users & Groups
After the SCIM configuration is connected, map the Users and groups. The high-level steps are:
- Create Persona Roles in Entra Groups
- Remap Application with Groups
Create Persona Roles in Entra Groups
- Go to Groups > Overview.
- Click New group.
- Go to the Users and groups section.
- Click Add user/group. Create one Group in Entra for each Persona Role. Give each Group exactly the same name as the role in Persona.
- After you create the Groups, add the applicable Users to the Entra Groups.
Make sure that each Entra Group name matches the Persona Role name exactly.
Remap Application with Groups instead of Users
- Go back to the application from the Enabling SCIM Provisioning section.
- Click the Assign Users and Groups tile, or go to the Users and Groups Section.
- Click Add user/group, and add the Groups that match the Persona roles.
- Go back to Overview (Preview), and click ▷ Start Provisioning.
- Wait until provisioning is complete. The setup is then complete.
You can check the Provisioning logs for results at all times.
Plans Explained
SCIM with Microsoft Entra by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| SCIM with Microsoft Entra | Not Available | Not Available | Not Available | Available |