SCIM provisioning with Microsoft Entra ID
*Please note that the actual setup procedure may differ from the latest version.
This article explains how to set up SCIM provisioning with Microsoft Entra ID.
These settings are configured within Microsoft Entra ID.
If you have not registered an account yet, please check the Azure Free Account FAQ.
Entra ID settings
First, create an enterprise application.
01. Open enterprise applications
Sign in to Microsoft Azure with an administrator account.
Navigate to All services under Microsoft Azure, and select ID then Microsoft Entra ID from the left side of the screen.
Click Enterprise applications on the left side menu.
02. Select new application
Click All applications then New application.
03. Click Create your own application.
04. Create your own application
First, enter a name for the application you want to connect in the What's the name of your app field.
Next, select Integrate any other application you don't find in the gallery (Non-gallery).
Click Create.
Provisioning
Configure the provisioning settings.
01. Select provisioning
Configure the provisioning settings.
Click Provisioning on the side menu of the app, or click Provision User Accounts.
Next, click Get Started.
Select Automatic under the Provisioning mode.
02. Integrate Entra ID with learningBOX
Set up admin credentials to integrate Entra ID with learningBOX.
First, log in to learningBOX.
Go to Site customizer > Basic settings > System integration > SCIM > tick Enable SCIM provisioning in the SCIM tab, and save your changes.
Open the Base URL and Token tab on the learningBOX side, copy the Base URL and Access token, and enter them into Entra ID in the next step.
▼ Base URL
Copy the Base URL by clicking Copy.
▼Token
Click Generate, and copy the token from the pop-up window that appears.
Return to Entra ID and enter the following details to complete the connection setup:
・Tenant URL: The Base URL copied from learningBOX
・Secret token: The Token issued in learningBOX
If you regenerate the token after completing the integration with Entra ID, you must reconfigure these settings.
Click Test Connection and verify that a connection successful message appears.
Click Save to complete the connection configuration.
03.Group and user settings
To provision groups, set Provision Microsoft Entra ID Groups to be enabled.
Next, configure the settings to enable user provisioning.
Click Provision Microsoft Entra ID Users.
Set Enabled to Yes, and tick all boxes under Target Object Actions.
Next, configure the Mappings.
Because the login (Login ID) field key in learningBOX corresponding to userName must be at least five characters long, if the length is too short, select Expression under Mapping Type and add it to Expression as shown in the example below.
Example:
Append("prefix_", [mailNickname]), Append([mailNickname], "abc"), etc.
*Enter any characters in "".
login (login ID) can be made up of numbers, letters and the following symbols.
! " # $ % & ' ( ) * + , - . / : ; ? [ ] ^ _ `
For the name (Name) field key on the learningBOX side, if the corresponding Microsoft Entra ID attribute name.formatted uses the default value Join(" ", [givenName], [surname]), the user's first and last names will be reversed when synchronized.
To avoid this, configure the setting in attribute mapping as follows:
Join(" ", [surname], [givenName])
Click Save in Attribute Mapping.
Finally, set Provisioning Status to On and click Save.
04. Start provisioning
This section explains how to add users for provisioning.
Add the users or groups you want to provision from Users and groups > + Add user or group.
By default, automatic provisioning runs approximately every 40 minutes.
You can also manually stop or start provisioning.
Once you confirm the provisioning results, the setup is complete.
If the group displayed under Users and groups is considered the first level, groups and users in lower levels will be synced to learningBOX up to the second level.
Because the third level and below will not be synced, measures such as assigning them to the first level are required.
Note
Immediate manual synchronization is available instead of automatic synchronization at 40-minute intervals.
Select the user or group from Provision on demand and run provisioning.
